{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Drupal Commerce Core access bypass actively exploited (CVE-2026-118539, SA-CONTRIB-2026-254) · updates",
  "home_page_url": "https://pwn.watch/i/drupal-commerce-core-access-bypass-cve-2026-118539",
  "feed_url": "https://pwn.watch/i/drupal-commerce-core-access-bypass-cve-2026-118539/feed.json",
  "description": "Drupal Commerce Core, the shopping cart and checkout module for Drupal stores, doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor. The Drupal Security Team rates it Highly critical (21/25, no access needed) and says it is being actively exploited in the wild. Upgrade to Commerce Core 3.3.13 or 8.x-2.41, and audit orders for inconsistencies.",
  "language": "en",
  "_pwn": {
    "slug": "drupal-commerce-core-access-bypass-cve-2026-118539",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/drupal-commerce-core-access-bypass-cve-2026-118539/feed.xml",
    "llms": "https://pwn.watch/i/drupal-commerce-core-access-bypass-cve-2026-118539/llms.txt",
    "json": "https://pwn.watch/i/drupal-commerce-core-access-bypass-cve-2026-118539.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/drupal-commerce-core-access-bypass-cve-2026-118539#2026-10-28-95f927c0",
      "url": "https://pwn.watch/i/drupal-commerce-core-access-bypass-cve-2026-118539#2026-10-28-95f927c0",
      "title": "Drupal Commerce Core access bypass actively exploited (CVE-2026-118539, SA-CONTRIB-2026-254): Drupal Security Team publishes SA-CONTRIB-2026-254 (CVE-2026-118539): Highly critical access bypass in Commerce Core, actively exploited in the wild; fixed in 3.3.13 and 8.x-2.41.",
      "content_text": "Drupal Commerce Core access bypass actively exploited (CVE-2026-118539, SA-CONTRIB-2026-254): Drupal Security Team publishes SA-CONTRIB-2026-254 (CVE-2026-118539): Highly critical access bypass in Commerce Core, actively exploited in the wild; fixed in 3.3.13 and 8.x-2.41.\n\nSource: https://www.drupal.org/sa-contrib-2026-254",
      "date_published": "2026-10-28T00:00:00.000Z",
      "external_url": "https://www.drupal.org/sa-contrib-2026-254",
      "tags": [
        "critical"
      ]
    }
  ]
}