- Package
- drupal/commerce
- Fixed in
- 2.41.0, 3.3.13
- Published
- Wed 28 Oct 2026, 16:55 LisbonUpdated Mon 2 Nov 2026, 07:26 Lisbon
In plain words
A user who can create stores or edit their own store can make their store the site's default store, causing it to receive some orders it should not receive. Only sites that give these permissions to untrusted users are affected, such as marketplaces where vendors manage their own stores.
Am I affected?
Find drupal/commerce and its version in composer.lock. The advisory lists fixes in 2.41.0 and 3.3.13, but does not specify affected version ranges. Check whether untrusted users have permission to create stores or edit their own store. Only sites granting those permissions to untrusted users are affected.
What to do
Check which version you have, then update to a fixed release for your branch (2.41.0, 3.3.13):
composer show drupal/commerce | grep versions
composer update drupal/commerceIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
The advisory's description
This module enables you to sell goods and services to customers through a shopping cart and checkout form. Sites can also create multiple online stores that are managed by different users.
The module doesn't check access properly when a store is saved. A user who can either create stores or edit their own store is able to mark their store as the site's default store. This causes their store to get some orders they normally shouldn't.
Only sites that give those permissions to untrusted users are affected (for example, marketplace sites where vendors manage their own stores).