What is the CVSS score of CVE-2026-15089?

CVE-2026-15089 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Drupal Commerce are affected by CVE-2026-15089?

A critical authentication bypass in Drupal Commerce Guest Registration allows unauthenticated attackers to circumvent identity verification during checkout, exposing customer accounts and order data…

How to fix or mitigate CVE-2026-15089?

Within 24 hours: immediately identify whether your organization deployed Drupal Commerce Guest Registration module; if present, disable guest checkout functionality or the module entirely and escalate to the security and commerce teams. Within 7 days: implement compensating controls including mandatory out-of-band identity verification (email/SMS confirmation), deploy WAF signatures to detect authentication bypass attempts, and conduct a targeted audit of guest registrations and orders placed since module deployment. Within 30 days: monitor Drupal security advisory SA-CONTRIB-2026-079 for patch release; apply the patch immediately upon availability, conduct full forensic review of accessed accounts, and notify affected customers per breach notification protocols if unauthorized access is confirmed.

Drupal Commerce CVE-2026-15089

EUVD-2026-43088 CRITICAL

Improper Authentication (CWE-287)

2026-07-10 drupal

GHSA-5688-w7cj-j738

Authentication Bypass Drupal Commerce Guest Registration

9.1

CVSS 3.1 · Vendor: drupal

Severity by source

Vendor (drupal) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Network-reachable guest-registration flow needs no auth or interaction (AV:N/AC:L/PR:N/UI:N); authentication bypass exposes and lets attacker alter account data (C:H/I:H) with no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (drupal).

CVSS VectorVendor: drupal

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 19:33 vuln.today

CVSS changed

Jul 13, 2026 - 19:22 NVD

9.1 (CRITICAL)

CVE Published

Jul 10, 2026 - 21:54 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 10, 2026 - 21:54 cve.org

CRITICAL 9.1

DescriptionCVE.org

vulnerability in Drupal Commerce guest registration allows . This issue affects Commerce guest registration versions: *.*.

AnalysisAI

Authentication bypass in the Drupal Commerce Guest Registration contributed module allows remote unauthenticated attackers to circumvent identity verification during the guest checkout/registration flow, per Drupal advisory SA-CONTRIB-2026-079. The CVSS 9.1 scoring (C:H/I:H) indicates an attacker can gain unauthorized access to or hijack account/order data without credentials or user interaction. No public exploit has been identified at time of analysis, and the low EPSS score (0.24%, 15th percentile) suggests exploitation is not yet widespread.

Technical ContextAI

The affected component is the Commerce Guest Registration module, a contributed add-on for Drupal Commerce that automatically creates or links user accounts for shoppers who check out as guests. The root cause is classified as CWE-287 (Improper Authentication), meaning the module fails to correctly verify a user's claimed identity - likely allowing a guest-registration path to attach to, or authenticate as, an existing account without proving ownership (e.g., via a matching email address). The affected CPE is cpe:2.3:a:drupal:commerce_guest_registration, and the flaw sits in the account-provisioning logic that bridges anonymous checkout sessions to persistent Drupal user accounts.

RemediationAI

Consult Drupal advisory SA-CONTRIB-2026-079 (https://www.drupal.org/sa-contrib-2026-079) and upgrade the Commerce Guest Registration module to the fixed release listed there; the input data does not specify an exact fix version, so the patched version must be confirmed directly from that advisory (Patch available per vendor advisory). Until the module is updated, apply compensating controls: disable the Commerce Guest Registration module and require standard authenticated checkout (trade-off: removes guest-checkout convenience and may reduce conversions), or restrict/monitor guest-registration and account-creation endpoints and enforce email verification before any guest account is linked to order data. Review logs for unexpected account linkages or logins tied to guest checkouts, and audit existing guest-created accounts for signs of takeover.