This module enables you to sell goods and services to customers through a shopping cart and checkout form. When Drupal Commerce is used with the JSON:API modul... (CVE-2026-118540)

Package: drupal/commerce
Fixed in: 2.41.0, 3.2.0
Published: Wed 28 Oct 2026, 16:55 LisbonUpdated Mon 2 Nov 2026, 07:27 Lisbon

In plain words

When Drupal Commerce is used with the JSON:API module, users without permission may be able to access unpublished product variations. Only sites with published products and unpublished product variations are affected.

Am I affected?

Find drupal/commerce and its version in composer.lock. The advisory lists 2.41.0 and 3.2.0 as fixed versions but gives no affected version range. Check whether your site uses the JSON:API module and has published products and unpublished product variations.

What to do

Check which version you have, then update to a fixed release for your branch (2.41.0, 3.2.0):

composer show drupal/commerce | grep versions
composer update drupal/commerce

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

The advisory's description

This module enables you to sell goods and services to customers through a shopping cart and checkout form.

When Drupal Commerce is used with the JSON:API module, it is possible for unpublished product variations to be accessible to users without permission.

This vulnerability is mitigated by only affecting sites with published products and unpublished product variations.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.