- Package
- drupal/commerce_shipping
- Fixed in
- 2.16.0, 3.0.6
- Published
- Wed 28 Oct 2026, 16:56 LisbonUpdated Mon 2 Nov 2026, 08:25 Lisbon
In plain words
The module does not sufficiently protect shipment references and shipment entity fields. An attacker who has a cart with API-based access could bypass access controls to change shipment states inappropriately or delete shipments.
Am I affected?
Look for drupal/commerce_shipping and its version in composer.lock. The advisory lists 2.16.0 and 3.0.6 as fixed versions but gives no affected version ranges. Check whether an attacker could have a cart with API-based access to manipulate its shipments, as this is the stated condition for the flaw.
What to do
Check which version you have, then update to a fixed release for your branch (2.16.0, 3.0.6):
composer show drupal/commerce_shipping | grep versions
composer update drupal/commerce_shippingIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
If you cannot update yet
The vulnerability is mitigated by the requirement that an attacker must have a cart with API-based access to manipulate its shipments.
The advisory's description
This module enables you to sell tangible products via Drupal Commerce that are organized into shipments for fulfillment.
The module doesn't sufficiently protect shipment references and shipment entity fields, leading to an access bypass that can result in inappropriately modified shipment states or deleted shipments.
This vulnerability is mitigated by the fact that an attacker must have a cart with API-based access to manipulate its shipments.