Note: This data is for reference and cybersecurity research purposes only.CyStack advises users not to use this information for unlawful purposes.
CVE-2026-118539 is a vulnerability classified as Missing Authorization, affecting Commerce Core (affected versions: 0.0.0 – < 2.41 and 3.0.0 – < 3.3.13). This vulnerability is rated Medium, with a CVSS score of 6.5. Current sources do not report this vulnerability as exploited.
A short verification protects the vulnerability source and prevents automated AI abuse.
Verifying...
Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
en
