Drupal Commerce Core Critical Authorization Bypass Flaw Under Active Exploitation (CVE-2026-118539)

The Drupal Security Team has issued an emergency security advisory, designated SA-CONTRIB-2026-254, confirming that threat actors are actively exploiting a critical authorization bypass vulnerability in Drupal Commerce Core. Tracked as CVE-2026-118539 and rated 21/25 (Highly Critical) under Drupal's internal risk assessment framework, the flaw allows authenticated users or checkout guests to manipulate core transactional fields across active shopping carts and orders.

Because Drupal Commerce powers thousands of enterprise retail stores, B2B wholesale portals, and subscription billing platforms globally, active exploitation represents an immediate financial fraud and inventory loss risk.

Vulnerability Mechanics: Missing Entity Authorization on REST & Checkout Routes

Drupal Commerce leverages Drupal's Entity API and routing architecture to manage products, variations, orders, and payment transactions. Under modern decoupled and headless architectures, stores increasingly expose checkout workflows via REST and JSON:API endpoints.

The vulnerability stems from an inconsistency in route access checking across several core controller endpoints:

• Unprotected Entity Field Mutation: Specific route handlers failed to enforce field-level access control when processing PATCH or POST requests against active order objects.
• Price & Total Tampering: A malicious user possessing a standard customer account (or an anonymous guest session during checkout) could submit crafted JSON payloads directly modifying restricted properties—such as changing an item's unit_price from $500.00 to $0.01.
• Order State Forgery: In certain configurations, attackers successfully manipulated the order state transition machine, forcing an order into "Completed" or "Processing" status without generating an approved payment transaction through the payment gateway.

// Example of an unauthorized JSON:API PATCH payload exploiting CVE-2026-118539:
PATCH /jsonapi/commerce_order/default/a89f201b-c12e-4890 HTTP/1.1
Host: store.enterprise-retail.com
Authorization: Bearer customer_jwt_token
Content-Type: application/vnd.api+json

{
  "data": {
    "type": "commerce_order--default",
    "id": "a89f201b-c12e-4890",
    "attributes": {
      "total_price": {
        "number": "1.00",
        "currency_code": "USD"
      },
      "state": "completed"
    }
  }
}
// Flawed controller accepted the attribute update without verifying merchant administrative privileges!

Affected Branches and Patched Versions

Because the vulnerability resides in the contributed Drupal Commerce module rather than Drupal Core itself, updating the underlying CMS does not resolve the issue. Merchants must explicitly update the Commerce module:

Merchant Incident Response & Forensic Audit Checklist

Because active in-the-wild exploitation has been verified, security teams operating Drupal Commerce storefronts must execute the following response protocol:

1. Deploy the Security Release Immediately: Execute Composer updates to install Commerce 3.3.13 or 8.x-2.41 across all production environments:

   composer update drupal/commerce --with-dependencies

2. Audit Historical Order Ledgers: Query the database for discrepancy patterns between recorded order totals and actual gateway settlement amounts:

   -- SQL Query: Identify orders with anomalous price modifications
   SELECT order_id, total_price__number, state, completed 
   FROM commerce_order 
   WHERE total_price__number < 5.00 AND state = 'completed';

3. Review Web Server Access Logs: Inspect access logs for direct PATCH or POST requests targeting /jsonapi/commerce_order/ originating from non-administrative IP addresses.