L4 · Septic Tank BlewDrupal · Commerce · access bypassdrupal-commerce-october

Drupal Commerce fixes six flaws, including an actively exploited access bypass

Drupal confirms exploitation of Commerce Core route/field access bypass CVE-2026-118539. The October 28 batch fixes six flaws. Upgrade to 3.3.13 or 8.x-2.41 and audit orders for inconsistencies.

Disclosed: Oct 28, 2026; Public disclosure date
Severity: Septic Tank Blew; 6 CVEs tracked here
Splash zone: Drupal Commerce Core before 2.41 or 3.0.0–3.3.12; the exploited flaw needs no authenticated account; php
In the wild: Yes; Drupal confirms active exploitation of CVE-2026-118539, not every flaw in the batch.

What happened

The exploited flaw requires no authenticated account and affects Commerce Core, not Drupal core. It is grouped with the five sibling advisories from the same release batch. No victim count or published static indicators are provided. L4 reflects confirmed exploitation; the other issues have different permissions and configuration prerequisites.

What’s in the bowl

CVE-2026-118539

Route and entity-field access bypass

Insufficient access checks can financially harm the merchant; active exploitation confirmed.

CVE-2026-118540

Unpublished variation disclosure

JSON:API can expose unpublished variations of published products. Commerce 3.3.x is unaffected by this particular flaw.

CVE-2026-118541

Cross-promotion coupon changes

Users managing their own promotions can change other promotions’ coupons when JSON:API or REST writes are enabled.

CVE-2026-118542

Default-store access bypass

Untrusted users with store creation or own-store edit permissions can change the default store and receive other orders.

CVE-2026-118543

Commerce inbox CSRF

A crafted page can trick a commerce administrator into dismissing shared notices, including security notifications.

CVE-2026-118544

Variation field inference

Repeated JSON:API queries can disclose fields on product variations the visitor cannot view.

Fixed versions

Product	Safe from	Note
Commerce Core 3.x	`3.3.13`
Commerce Core 8.x-2.x	`8.x-2.41`

Crime-scene timeline

Oct 28, 2026
Six Commerce Core advisories and fixes published
SA-CONTRIB-2026-254 confirms exploitation and recommends auditing orders.

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.