Threat reportVulnerabilityTL-2026-4814
Drupal Commerce Core Authorization Bypass (CVE-2026-118539) Actively Exploited
Drupal Commerce Core Authorization Bypass (CVE-2026-118539) (TL-2026-4814), also tracked as SA-CONTRIB-2026-254, is a critical-severity software vulnerability, first published 2026-10-30. It has no confirmed attribution, affects Drupal Commerce Core, references 1 CVE (CVE-2026-118539), maps to 5 MITRE ATT&CK techniques (T1005, T1190, T1213), and is covered by 9 detection rules and 12 indicators of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-4814
- Threat ID
- TL-2026-4814
- Also known as
- SA-CONTRIB-2026-254
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- retail, ecommerce, finance
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 12
Malware and tooling in Drupal Commerce Core Authorization Bypass (CVE-2026-118539)
Malware and tooling: PHP
How Drupal Commerce Core Authorization Bypass (CVE-2026-118539) works
A missing-authorization flaw (CWE-862) in the Drupal Commerce Core module lets attackers bypass access controls on certain routes and entity fields, with potential financial harm to vendors. Drupal rates it Highly Critical (21/25) and states it is being actively exploited in the wild.
Drupal security advisory SA-CONTRIB-2026-254 (published 2026-10-28) describes an access bypass in the Commerce Core contributed module: insufficient protection of 'certain routes and entity fields' allows attackers to reach restricted functionality and data. NVD classifies the weakness as Missing Authorization (CWE-862) allowing Forceful Browsing. The advisory carries a Drupal risk score of 21/25 (Highly Critical) and explicitly states that the vulnerability is being actively exploited in the wild.
Affected versions are Commerce Core 0.0.0 through 2.41 (advisory lists < 2.41) and 3.0.0 through 3.3.13 (advisory lists >= 3.0.0 < 3.3.13). Fixes are Commerce Core 3.3.13 for the 3.x branch and 8.x-2.41 for earlier versions. Release 3.3.13 (2026-10-28, Drupal 10.3+ and 11.x) bundles six Commerce security fixes (SA-CONTRIB-2026-254 through -259), of which -254 is the only Highly Critical one.
The advisory notes the financial impact on vendors and recommends that administrators upgrade immediately and audit their orders for inconsistencies. No threat actor, campaign scope, malware, network IOCs, public PoC or CISA KEV listing is provided in the sources reviewed; no CVSS score has been published at the time of writing, so severity reflects Drupal's Highly Critical rating and confirmed in-the-wild exploitation. Exact exploit mechanics (specific routes/fields) are not disclosed publicly in the sources.
MITRE ATT&CK techniques used in TL-2026-4814
Collection
T1005 Data from Local System; T1213 Data from Information Repositories
Initial Access
T1190 Exploit Public-Facing Application
Impact
Affected products and versions in Drupal Commerce Core Authorization Bypass (CVE-2026-118539)
- Drupal — Commerce Core
Vulnerable versions: 0.0.0 through 2.41; 3.0.0 through 3.3.13 (before the 3.3.13 fix)
Fixed in: 3.3.13; 8.x-2.41
Remediation for Drupal Commerce Core Authorization Bypass (CVE-2026-118539)
Patches
- drupal/commerce 3.3.13 (composer require 'drupal/commerce:^3.3')
- drupal/commerce 8.x-2.41
Immediate actions
- Upgrade Drupal Commerce Core to 3.3.13 (3.x) or 8.x-2.41 (earlier branches) immediately
- Audit orders for inconsistencies, as recommended in SA-CONTRIB-2026-254
- Review web server and Drupal access logs for unauthorized requests to Commerce routes
Workarounds
- No workaround documented in the sources; upgrade is the recommended action
Longer-term hardening
- Subscribe to Drupal security advisories (SA-CONTRIB) and track contributed-module updates via composer
- Apply the other Commerce fixes released alongside it (SA-CONTRIB-2026-255 to -259)
CVEs associated with Drupal Commerce Core Authorization Bypass (CVE-2026-118539)
Weaknesses (CWE) in Drupal Commerce Core Authorization Bypass (CVE-2026-118539)
Timeline of Drupal Commerce Core Authorization Bypass (CVE-2026-118539)
- Advisory credits Dan Puccetti, Marcus Johansson and Robert Snyder as reporters; coordinated by the Drupal Security Team
- Release 3.3.13 also ships fixes for five companion Commerce advisories: SA-CONTRIB-2026-255 (information disclosure), -256 (access bypass, less critical), -257 (access bypass), -258 (CSRF) and -259 (information disclosure); only -254 is Highly Critical
- Advisory states the vulnerability is being actively exploited and urges administrators to upgrade and audit orders for inconsistencies
- Commerce Core 3.3.13 and 8.x-2.41 released with the fix; 3.3.13 also bundles SA-CONTRIB-2026-255 through -259
- Drupal Security Team publishes SA-CONTRIB-2026-254 (Highly Critical, 21/25) for Commerce Core access bypass, stating active exploitation in the wild
- The Hacker News reports active exploitation of the Drupal Commerce Core authorization bypass
- NVD record for CVE-2026-118539 published (CWE-862 Missing Authorization / Forceful Browsing); no CVSS score yet
Sources cited for Drupal Commerce Core Authorization Bypass (CVE-2026-118539)
Detection coverage for TL-2026-4814
As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4814 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.