This module enables you to sell tangible products via Drupal Commerce that are organized into shipments for fulfillment. The module doesn't sufficiently check... (CVE-2026-118557)

Package: drupal/commerce_shipping
Fixed in: 2.16.0, 3.0.6
Published: Wed 28 Oct 2026, 16:56 LisbonUpdated Mon 2 Nov 2026, 07:25 Lisbon

In plain words

Drupal Commerce Shipping does not sufficiently check access to the form for resending receipts. Under certain configurations, this lets some users access receipts and customer information for orders they should not be able to access.

Am I affected?

Look for drupal/commerce_shipping and its version in composer.lock. The advisory lists 2.16.0 and 3.0.6 as fixed versions but gives no affected version ranges. Review access to the resend receipts form; the advisory does not identify which configurations allow the unauthorised access.

What to do

Check which version you have, then update to a fixed release for your branch (2.16.0, 3.0.6):

composer show drupal/commerce_shipping | grep versions
composer update drupal/commerce_shipping

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

The advisory's description

This module enables you to sell tangible products via Drupal Commerce that are organized into shipments for fulfillment.

The module doesn't sufficiently check access on the form to resend receipts. Under certain configurations, this allows some users to gain access to receipts and customer information for orders they should not be able to access.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.