Our takeDrupal Commerce Core 2.41 and earlier or 3.3.13 and earlier has a missing-authorization bug now exploited in the wild. Patch it.Security Resilience desk
Sources (3)
- hackernews · hackernews
- bleeping · bleeping
- securityweek · securityweek
What this means for you — Security leader:Update Commerce Core to 2.42 or 3.3.14+ immediately if you run Drupal Commerce; the missing-authorization flaw (CVE-2026-118539) is already exploited in the wild.
What this means for you — Lean IT orgs:If your website uses Drupal Commerce, update the Commerce Core module to version 2.42 or 3.3.14 right away. Attackers are already using this flaw to bypass authorization.
What this means for you — MSP:Check every Drupal Commerce site you manage for versions 0.0.0–2.41 or 3.0.0–3.3.13 and update Commerce Core to 2.42 or 3.3.14+; the authorization bypass is under active exploitation.
What this means for you — Researcher:Drupal Commerce Core 2.42 and 3.3.14 fix an actively exploited missing-authorization vulnerability (CVE-2026-118539) reachable through the shopping cart.