# Drupal Commerce Core Authorization Bypass (CVE-2026-118539) Actively Exploited

> A missing-authorization flaw (CWE-862) in the Drupal Commerce Core module lets attackers bypass access controls on certain routes and entity fields, with potential financial harm to vendors. Drupal rates it Highly Critical (21/25) and states it is being actively exploited in the wild.

- **Published:** 2026-10-30T09:03:46Z
- **Last reviewed:** 2026-10-30T09:03:46Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4814
- **ID:** TL-2026-4814
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-118539

## Description

Drupal security advisory SA-CONTRIB-2026-254 (published 2026-10-28) describes an access bypass in the Commerce Core contributed module: insufficient protection of 'certain routes and entity fields' allows attackers to reach restricted functionality and data. NVD classifies the weakness as Missing Authorization (CWE-862) allowing Forceful Browsing. The advisory carries a Drupal risk score of 21/25 (Highly Critical) and explicitly states that the vulnerability is being actively exploited in the wild.

Affected versions are Commerce Core 0.0.0 through 2.41 (advisory lists < 2.41) and 3.0.0 through 3.3.13 (advisory lists >= 3.0.0 < 3.3.13). Fixes are Commerce Core 3.3.13 for the 3.x branch and 8.x-2.41 for earlier versions. Release 3.3.13 (2026-10-28, Drupal 10.3+ and 11.x) bundles six Commerce security fixes (SA-CONTRIB-2026-254 through -259), of which -254 is the only Highly Critical one.

The advisory notes the financial impact on vendors and recommends that administrators upgrade immediately and audit their orders for inconsistencies. No threat actor, campaign scope, malware, network IOCs, public PoC or CISA KEV listing is provided in the sources reviewed; no CVSS score has been published at the time of writing, so severity reflects Drupal's Highly Critical rating and confirmed in-the-wild exploitation. Exact exploit mechanics (specific routes/fields) are not disclosed publicly in the sources.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1213 Data from Information Repositories
- T1005 Data from Local System
- T1565.001 Stored Data Manipulation
- T1657 Financial Theft

## Sources

- [Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw](https://thehackernews.com/2026/10/hackers-actively-exploit-highly.html)
- [Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254](https://www.drupal.org/sa-contrib-2026-254)
- [NVD - CVE-2026-118539](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-118539)
- [Commerce 3.3.13 release notes](https://www.drupal.org/project/commerce/releases/3.3.13)
- [Drupal Commerce project repository](https://git.drupalcode.org/project/commerce)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4814