- Package
- drupal/commerce
- Fixed in
- 2.41.0, 3.3.13
- Published
- Wed 28 Oct 2026, 16:54 Lisbon
In plain words
Drupal Commerce does not sufficiently protect certain routes and entity fields, allowing an attacker to bypass access controls. This may financially affect the vendor. The description reports active exploitation, although the advisory's separate exploitation flag says otherwise.
Am I affected?
Look for drupal/commerce and its version in composer.lock. The advisory lists 2.41.0 and 3.3.13 as fixed versions but gives no affected version range, so it does not establish which other versions are vulnerable. It names no configuration, feature or database condition to check beyond the package version.
What to do
Check which version you have, then update to a fixed release for your branch (2.41.0, 3.3.13):
composer show drupal/commerce | grep versions
composer update drupal/commerceIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
The advisory's description
This module enables you to sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs.
The module doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor.
This vulnerability is being actively exploited in the wild.