Drupal Commerce CVE-2026-15089

Exploitation requires that the target Drupal Commerce site has the contributed Commerce Guest Registration module installed and enabled, with the guest checkout/registration flow reachable - this is the specific feature that must be deployed for the vulnerability to exist. Given the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special client-side conditions are needed once that module is active; the attack is remote and unauthenticated against sites using guest registration. The primary limiting factor is deployment: sites not running this contrib module, or those requiring full authenticated registration, are not exposed. Note the source description is truncated, so the precise triggering input should be confirmed against SA-CONTRIB-2026-079.

Signals are moderately conflicting. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes an easily reachable, network-based, unauthenticated attack with high confidentiality and integrity impact, warranting a 9.1 'Critical' rating. However, the EPSS probability is low (0.24%, 15th percentile), there is no CISA KEV listing, and no public exploit is identified - so real-world exploitation is currently unproven rather than active. This looks like a genuine priority for any site actually running the module (authentication bypasses are high-value), but the abstract 'versions *.*' data and absence of concrete exploit code mean the raw 9.1 may overstate immediate mass-exploitation risk relative to targeted, opportunistic abuse. The description is truncated ('allows .') so the precise attacker capability is not fully confirmed from the input and should be verified against the vendor advisory.

An attacker submits a crafted guest-registration or guest-checkout request over the network, supplying the email address (or identifier) of an existing customer account. Because the module improperly verifies identity, the request is authenticated or linked as that victim, granting the attacker access to the victim's account or order/PII data without credentials or user interaction. No public proof-of-concept has been identified at time of analysis, but the low complexity (AC:L) makes the flow straightforward to abuse once the exact defect is known.