- Package
- drupal/commerce
- Fixed in
- 2.41.0, 3.3.13
- Published
- Wed 28 Oct 2026, 16:55 LisbonUpdated Mon 2 Nov 2026, 07:26 Lisbon
In plain words
A user who is only allowed to manage their own promotions can change or delete coupons belonging to other promotions. This is possible because the module does not sufficiently check access to the relationship between promotions and coupons. The site must accept writes through JSON:API or REST, which is not enabled by default.
Am I affected?
Look for drupal/commerce and its installed version in composer.lock. The advisory lists fixes in 2.41.0 and 3.3.13, but gives no affected version ranges. Check whether your site accepts writes through JSON:API or REST and allows users to manage only their own promotions.
What to do
Check which version you have, then update to a fixed release for your branch (2.41.0, 3.3.13):
composer show drupal/commerce | grep versions
composer update drupal/commerceIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
If you cannot update yet
Ensure the site does not accept writes through JSON:API or REST. These writes are not enabled by default.
The advisory's description
This module enables you to sell goods and services to customers through a shopping cart and checkout form. It includes a feature to manage promotions and the coupons that apply them.
The module doesn't sufficiently check access to the relationship between promotions and coupons. A user who is only allowed to manage their own promotions can delete or change coupons that belong to other promotions.
This vulnerability is mitigated by the fact that the site must accept writes through JSON:API or REST, which is not enabled by default.