CVE-2026-118539
Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254title from the CVE record
Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.
- CVSS
- Unavailable
- EPSS (exploit probability)
- Unavailable
- CISA KEV
- Not listed
EPSS trendFIRST daily scores, last 90 days
Unavailable
Learn