syslog.eu
CS EN DE FR
[CRIT · FIX TODAY]/News·

Drupal Commerce Core: access bypass exploited without login – update, then audit your orders

On October 28, Drupal's security team warned of active attacks on a highly critical access bypass in Commerce Core, the module that adds carts and checkout to Drupal sites. An attacker needs no account. Fixed releases are out; Drupal asks shops to go through their orders and warns the flaw may cost the seller money.

Affected commerce-core drupal
Syslog card, level CRIT (fix today): Drupal shops attacked, no login needed; Drupal: audit your orders. Affected: Drupal, Commerce Core. To do: Update Commerce to 3.3.13 or 8.x-2.41; Audit recent orders for inconsistencies.

Does this concern you?

  • Affected: companies whose web shop runs on Drupal with Commerce Core, and agencies or MSPs that run such shops for clients. Mezha and RuntimeWire put the module on more than 42,000 reported sites.
  • Skip it if: your shop runs on another platform, or your Drupal site does not use the Commerce module.

What to do

  • Check your Commerce Core release: on Composer-managed sites, composer show drupal/commerce.
  • On the 3.x branch, move to 3.3.13; on anything older, to 8.x-2.41. Both releases contain the fix.
  • Can't update today? Drupal names no workaround, only the update. Until then, in our view, ship no order before your payment provider confirms it.
  • After updating, audit orders for inconsistencies, as Drupal asks. Drupal names neither what to look for nor when attacks began; they were already under way on October 28, so look back well before that date. In our view, compare every order marked as paid with your payment provider's records, and check prices and discounts against what you actually charge.
  • Found orders that don't match? In our view, hold their shipment until the payment is confirmed, and keep the web server logs from that period.

What we know – and what we don't

  • Drupal's advisory SA-CONTRIB-2026-254 rates the flaw 21 of 25, highly critical, and says it is being actively exploited in the wild. Certain routes and entity fields are not protected well enough; the CVE record files it as missing authorization (CVE-2026-118539).
  • The CVE description, quoted in reports, gives the range as "0.0.0 to 2.41, 3.0.0 to 3.3.13", as if the fixed releases were affected; the advisory and the record's version data list only versions below them.
  • Drupal gives no detail on who is attacking, how many shops were hit or what attackers change. RuntimeWire says the flaw targets prices, adjustments and whether payment ever happened; the advisory itself says only that it may financially impact the vendor.
  • Ratings differ. CISA's entry in the CVE record scores it 6.5, medium, and its assessment of October 30 recorded no known exploitation; the flaw was not in CISA's catalog of exploited vulnerabilities as of that day. Drupal's security team, which published the advisory, says it is exploited.

Why it matters

This flaw sits next to the money: the order and, per RuntimeWire, its price and payment status. An update stops new abuse, but only a look at past orders tells you whether goods already left the warehouse unpaid.

Sources

← All news