CVE-2026-118543 | Drupal up to 2.40.x/3.3.12 Commerce Core cross-site request forgery

October 30, 2026 Yanac

A vulnerability has been found in Drupal up to 2.40.x/3.3.12 and classified as problematic. The affected element is an unknown function of the component Commerce Core. Performing a manipulation results in cross-site request forgery.

This vulnerability is reported as CVE-2026-118543. The attack is possible to be carried out remotely. No exploit exists.

The affected component should be upgraded.VulDB Recent EntriesRead More