- Package
- drupal/commerce
- Fixed in
- 2.41.0, 3.3.13
- Published
- Wed 28 Oct 2026, 16:55 Lisbon
In plain words
An attacker can trick a user with the access commerce administration pages permission into visiting a crafted page that dismisses Commerce dashboard inbox notifications. The inbox routes do not check for a CSRF token. Because the inbox is shared, this hides the messages from every administrator, including notices about available security updates.
Am I affected?
Find drupal/commerce and its version in composer.lock. The advisory lists 2.41.0 and 3.3.13 as fixed versions but gives no affected version range. Check which users have the access commerce administration pages permission: the described attack requires tricking a user with that permission and affects the shared Commerce dashboard inbox.
What to do
Check which version you have, then update to a fixed release for your branch (2.41.0, 3.3.13):
composer show drupal/commerce | grep versions
composer update drupal/commerceIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
The advisory's description
This module enables you to sell goods and services to customers through a shopping cart and checkout form. It shows an inbox on the Commerce dashboard with announcements from the Drupal Commerce project, including notices about security updates.
Routes for the inbox do not check for a CSRF token. As a result, an attacker can trick a user with the "access commerce administration pages" permission into visiting a crafted page that will dismiss notifications for the messages. The inbox is also shared by all users, so if one commerce administrator is tricked, this hides the messages from every administrator, including notices that a security update is available.