Commerce Core - Missing Authorization (CVE-2026-118539)

CVE-2026-118539 is a missing authorization vulnerability in Drupal Commerce Core that enables forceful browsing of restricted resources. Remote unauthenticated attackers may access or modify some information, affecting Commerce Core versions through 2.41 and versions 3.0.0 through 3.3.13.

CrowdSec has been tracking this vulnerability and its exploits since 4th of November 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-118539 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers can exploit the guest-cart access bypass by adding a product through /product/{product_id}, then accessing /admin/commerce/orders/{order_id}/state/place with the guest session. Requests to this route that return the order state-transition confirmation form indicate unauthorized access to administrative order functionality.