PatchClock

PHP security digest · 23 Sep 2026

This module enables REST endpoints for a decoupled Commerce experience which allow for remote order creation. The module doesn't sufficiently sanitize order da...

Unrated CVE-2026-96378

Package
drupal/commerce_decoupled_checkout
Fixed in
1.8.0
Published
Wed 23 Sep 2026, 18:06 LisbonUpdated Mon 26 Oct 2026, 01:27 Lisbon

In plain words

The module does not sufficiently sanitise order data sent to its REST order creation endpoint. An attacker using that endpoint could set potentially unsafe properties on an order.

Am I affected?

Look for drupal/commerce_decoupled_checkout and its version in composer.lock. The advisory lists 1.8.0 as fixed but gives no affected version range. Check whether your project uses the module's REST endpoint for remote order creation, where the unsafe handling occurs.

What to do

Check which version you have, then update to a fixed release for your branch (1.8.0):

composer show drupal/commerce_decoupled_checkout | grep versions
composer update drupal/commerce_decoupled_checkout

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

The advisory's description

This module enables REST endpoints for a decoupled Commerce experience which allow for remote order creation.

The module doesn't sufficiently sanitize order data passed into the order creation endpoint, which allows for potentially unsafe order properties to be set on an order.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.