- Package
- drupal/commerce
- Fixed in
- 2.41.0, 3.3.13
- Published
- Wed 28 Oct 2026, 16:56 LisbonUpdated Mon 2 Nov 2026, 07:27 Lisbon
In plain words
A visitor can use repeated requests to work out certain field values on an unpublished product variation, or a variation of an unpublished product. This is possible when the core JSON:API module is enabled because product variation queries do not sufficiently restrict results to variations the visitor can view.
Am I affected?
Look for drupal/commerce and its version in composer.lock, then check whether the core JSON:API module is enabled. The advisory lists fixes in 2.41.0 and 3.3.13 but gives no affected version ranges. The disclosure concerns unpublished product variations and variations of unpublished products.
What to do
Check which version you have, then update to a fixed release for your branch (2.41.0, 3.3.13):
composer show drupal/commerce | grep versions
composer update drupal/commerceIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
If you cannot update yet
The vulnerability is mitigated by the requirement that the core JSON:API module must be enabled.
The advisory's description
This module enables you to sell goods and services to customers through a shopping cart and checkout form.
The module doesn't sufficiently restrict the product variations returned by entity queries to the variations the current user can view. When the core JSON:API module is enabled, a visitor can make repeated requests that eventually determine certain field values on an unpublished product variation, or a variation of an unpublished product.
This vulnerability is mitigated by the fact that the core JSON:API module must be enabled.