Drupal Commerce Core CVE-2026-118539

Exploitation targets Drupal Commerce Core (contrib module) installations running an affected version: 2.x prior to 2.41, or 3.0.0 up to but not including 3.3.13. The specific resource, route, or operation lacking the authorization check is not named in the available sources, so the exact feature or configuration that must be reachable cannot be enumerated beyond 'a Commerce Core endpoint subject to the missing authorization'. Limiting factors: the site must run a vulnerable version and the affected functionality must be deployed and network-reachable; impact is partial (C:L/I:L, no availability), and while the CVSS vector indicates PR:N (no authentication), the description does not confirm whether an anonymous or a low-privilege authenticated account is actually required - defenders should treat the precise privilege prerequisite as unconfirmed pending the vendor advisory.

This is a medium-severity access-control flaw (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) whose signals consistently point to a real-but-not-urgent issue rather than a top-priority emergency. The CVSS vector describes network-reachable, low-complexity exploitation with no privileges and no user interaction, but the impact is limited (C:L/I:L/A:N - partial confidentiality and integrity, no availability effect), which is why the score lands at 6.5 rather than critical. EPSS is low at 0.22% (13th percentile), indicating low modeled probability of exploitation in the near term, and the vulnerability is NOT listed in CISA KEV, so there is no confirmed active exploitation. No SSVC decision tree (exploitation/automatable/technical-impact) is supplied in the input; the only prioritization signal is vuln.today's 'this_month' label, which aligns with a patch-this-cycle posture rather than act-now. One point of tension worth verifying: the CVSS vector asserts PR:N (unauthenticated), yet the CWE-862 'Missing Authorization / Forceful Browsing' nature often means an authenticated low-privilege user reaches resources they should not - the description does not state whether an anonymous or logged-in user is required, so the exact privilege prerequisite should be confirmed with the Drupal advisory (SA-CONTRIB-2026-254). Net: a legitimate flaw to remediate on a normal patch cadence, not a drop-everything event.

An attacker directly requests a Drupal Commerce URL, endpoint, or resource that should be access-controlled and, because an authorization check is missing, is served the resource without proper permission (forceful browsing), exposing or allowing modification of commerce data they should not reach. Given AV:N/AC:L/UI:N this requires only crafted HTTP requests against a reachable site, but impact is partial (read/limited write, no availability loss). No public exploit code is identified at time of analysis; the only references are the vendor security advisory and the NVD record.