Hackers actively exploit critical Drupal Commerce Core authorization bypass flaw

Drupal is warning that a highly critical authorization-bypass vulnerability in its Commerce Core module is being exploited in the wild, according to The Hacker News. Tracked as CVE-2026-118539, the flaw affects the component that powers online storefronts built on Drupal, raising the risk of unauthorized access to e-commerce data and functions.

What happened

The Hacker News reports that Drupal published a security advisory, referenced as SA-CONTRIB-2026-254, stating the flaw is being actively exploited. Drupal gave no details on the nature of the activity or the scope of the campaign, according to the report. A CVSS score was not available at the time of the article, which listed it as "N/A."

Technical details

Per The Hacker News, the issue is a missing-authorization weakness: Drupal says the module does not sufficiently protect certain routes and entity fields. Commerce Core lets sites sell either through a traditional shopping cart and checkout form or through decoupled applications that reach the store over APIs. The report notes that an access bypass in this layer could have financial consequences for affected merchants, given that the module handles orders and payment-related flows. The article does not describe any exploitation technique in detail.

Who is affected

The Hacker News says the vulnerability affects Commerce Core versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13. Drupal credits researchers Dan Puccetti (dpuccetti), Marcus Johansson (marcus_johansson) and Robert Snyder (rsnyd) for the finding. Any site running a vulnerable Commerce Core build to sell goods or services online should treat itself as exposed while the flaw is under active exploitation.

What to do

The report says fixes are available and recommends upgrading without delay. Sites on the 3.x branch should move to Commerce Core 3.3.13, while earlier deployments should upgrade to Commerce Core 8.x-2.41. The Hacker News lists no interim workaround, so updating to the fixed release is the primary defense. Store operators should also review logs for signs of unauthorized access to orders, customer records or administrative routes, given that Drupal has confirmed exploitation but not detailed its scope.