Drupal Commerce Access Bypass Actively Exploited as Drupal Issues 39 Advisories

Operators of Drupal Commerce websites have been instructed to audit their orders after the Drupal Security Team confirmed that an access-bypass vulnerability is being actively exploited in the wild. The warning appears in SA-CONTRIB-2026-254, one of 39 contributed-project security advisories published on 28 October 2026 across 21 named projects.1 The vulnerability, CVE-2026-118539, received a Highly critical rating of 21 out of 25, the highest severity score in the latest batch.

The Commerce Core vulnerability stems from insufficient access checks on certain routes and entity fields, potentially allowing unauthorised access with financial consequences for vendors. Versions earlier than 8.x-2.41 on the Commerce 2.x branch and versions 3.0.0 through 3.3.12 on the 3.x branch are affected. The Security Team directs operators to update to Commerce Core 8.x-2.41 or 3.3.13, depending on the installed branch, and audit existing orders for inconsistencies. The advisory does not identify affected websites or quantify financial losses.

The disclosures extend beyond Commerce Core to other payment and store-management components. Of the 39 advisories, 12 concern Commerce Core, Commerce Stripe, Commerce Shipping and Commerce License. Across the complete batch, one advisory is rated Highly critical, 11 Critical, 24 Moderately critical and three Less critical. The vulnerabilities have different exploitation requirements and should not be treated as equally exposed or actively exploited.

A separate Critical advisory for Commerce Stripe identifies a cross-site request forgery vulnerability in the Stripe Connect authorisation process. An attacker could trick an administrator into following a crafted link that causes an order to be marked as paid without an actual payment. The issue affects Commerce Stripe versions 2.0.0 through 2.2.2 and is fixed in 2.2.3, while the 8.x-1.x branch is unaffected by this particular vulnerability. Two additional Commerce Stripe advisories address webhook-signature verification and cross-site scripting weaknesses under separate conditions.

Other Commerce-related disclosures concern shipment and licensing permissions. Commerce License insufficiently restricts changes to licence fields for users who own a licence and hold the update own commerce_license permission, which is not granted by default. An affected user could alter the rights granted by their licence, potentially escalating privileges as far as the Administrator role. The correction is available in Commerce License 3.1.1, while Commerce Shipping has separate fixes in versions 8.x-2.16 and 3.0.6.

Two Critical advisories for Single Content Sync identify vulnerabilities that could lead to remote code execution. One involves unsafe deserialisation of imported content, while the other concerns insufficient validation of file sources and destinations, potentially allowing arbitrary file writes, local file disclosure or server-side requests. Both require an attacker to hold the import single content permission, while code execution through the file-handling vulnerability additionally depends on the server permitting execution of attacker-controlled files. Version 1.4.19 fixes the issues, with the Security Team also instructing operators to run database updates, rebuild caches and restrict import permissions to highly trusted roles.

The AI module accounts for eight advisories involving cross-site scripting, information disclosure and access bypass. A Critical cross-site scripting vulnerability, CVE-2026-118549, concerns insufficient validation of Markdown links under certain conditions. The Security Team prescribes AI 1.4.11 or 1.5.2 for the affected supported branches and states that the 1.3.x branch is no longer supported. Other advisories address HTML rendering, chatbot input, text-format permissions and the handling of information in AI-related features.

One AI Search access-bypass advisory concerns cached Search API view results that may expose titles and displayed fields from unpublished or restricted content. Exploitation requires AI Search to be used with a Search API view that has result caching enabled and a previously executed search by a user authorised to access the restricted content. The same issue affects the standalone AI Search project, for which corrected alpha releases are available. The advisory explicitly excludes retrieval-augmented generation tools, AI Assistant RAG actions and custom Search API queries from this vulnerability.

Authentication weaknesses also feature in the batch. A Critical vulnerability in OAuth Login - OAuth OIDC SSO could allow an attacker to log in as an existing user whose email address is known, provided the attacker has an account with a configured identity provider and can control an attribute returned by that provider. Version 3.1.1 addresses the problem. Separately, OpenID Connect Client could allow account takeover through automatic email-based account linking when the identity provider does not verify email addresses. Version 2.3.1 disables linking new identities to existing accounts by default.

Two advisories revisit earlier security corrections. The Media Alias Display advisory states that the previous fix did not fully resolve an information-disclosure vulnerability involving the caching of protected files. Exploitation requires a non-public file scheme supplied by a custom or contributed module and a cached file previously requested by a more privileged user. Versions 2.1.3 and 3.0.3 provide the corrected releases.

The CAPTCHA advisory similarly identifies a remaining session-replay vulnerability following an earlier correction. A previously completed CAPTCHA challenge could be reused to submit a protected form without completing another challenge, weakening protections against automated submissions. The affected branches are corrected in CAPTCHA 8.x-1.18 and 2.0.11. Although the advisory's risk assessment indicates that exploit code is known to exist, it does not explicitly report ongoing attacks against websites.

Some operators must also investigate existing access settings after updating. The S3 File System advisory identifies a flaw that could result in unintended Amazon S3 object access-control settings or metadata corruption under particular configurations. Version 8.x-3.12 fixes the vulnerability, but operators using affected private-file takeover configurations or custom hooks are also advised to audit object permissions.

Three projects received Critical advisories without corresponding security-fix releases. The Drupal Security Team marked CacheFlush, PayUmoney for Drupal Commerce and GroupEx PRO integration unsupported because their maintainers have not fixed known security issues. The advisories instruct affected site operators to uninstall these projects rather than wait for an update. Sites depending on their functionality will need to account for that dependency when removing the unsupported software.

The new batch follows 34 contributed-project advisories published on 21 October 2026, which included a Highly critical remote code execution vulnerability in Ffmpeg Image Toolkit. The 28 October disclosures introduce a different immediate concern through the confirmed exploitation of Drupal Commerce and the requirement to examine existing orders. The Security Team's advisories establish separate responses for affected projects: updating supported releases, reviewing permissions and existing data where instructed, and removing unsupported modules. Confirmed active exploitation applies specifically to the Commerce vulnerability identified in SA-CONTRIB-2026-254 and should not be attributed to the entire batch.