CVE-2026-118542 | Drupal Commerce Core Plugin up to 2.40.x/3.3.12 improper authorization

October 30, 2026 Yanac

A vulnerability was found in Drupal Commerce Core Plugin up to 2.40.x/3.3.12 and classified as critical. The impacted element is an unknown function. Executing a manipulation can lead to improper authorization.

This vulnerability appears as CVE-2026-118542. The attack may be performed from remote. There is no available exploit.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More