Missing route and field access checks in Drupal Commerce Core allow order tampering (CVE-2026-118539)
Drupal published SA-CONTRIB-2026-254 saying the flaw is being exploited, so shops that don't upgrade risk tampered orders and direct financial loss.
Drupal Commerce Core does not properly protect some routes and entity fields. Attackers can get past access controls and change commerce data in ways that cost the merchant money. Drupal rates the issue Highly critical (21/25) and says it needs no special access conditions.
Affected: Drupal Commerce Core < 8.x-2.41; Drupal Commerce Core >= 3.0.0 < 3.3.13
How to Test
Check the installed Commerce Core (project machine name: commerce) version on the Drupal Extend/Update status page or in composer.lock. Any version below 8.x-2.41 on the 2.x branch, or from 3.0.0 up to but not including 3.3.13, is vulnerable. Following Drupal's advice, audit recent orders for inconsistencies such as unexpected prices, totals, or order states, and review web access logs for unusual requests to commerce routes.
How to Patch
Sites on 3.x should upgrade to Commerce Core 3.3.13. Sites on earlier versions should upgrade to Commerce Core 8.x-2.41.