EUVD-2026-66206
GHSA-x2xm-563p-wrqw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote, low-complexity, unauthenticated per NVD vector, but the 'Information Disclosure' tag supports C:H with I:N/A:N rather than the input's full I:H/A:H triplet.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
4DescriptionCVE.org
Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*.
AnalysisAI
Information disclosure in the Drupal Commerce Elavon payment-gateway module stems from improper input validation (CWE-20) and, per the NVD scoring, is reachable by remote unauthenticated attackers. The Drupal security advisory (SA-CONTRIB-2026-084) leaves the affected range wholly unspecified ('*.*'), so every published version should be treated as potentially vulnerable until a fixed release is identified. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must be a Drupal site with the Commerce Elavon contrib module installed and its Elavon payment method enabled and reachable - i.e., an operational checkout/payment path is the attack surface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals here conflict and should be weighed rather than taken at face value. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult Drupal advisory SA-CONTRIB-2026-084 (https://www.drupal.org/sa-contrib-2026-084) and upgrade the Commerce Elavon module to the fixed release it names; a specific fixed version was not provided in this data set, so do not assume a version number - treat the advisory's designated release as authoritative (Patch available per vendor advisory). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Drupal Commerce deployments to identify running versions of the Elavon payment-gateway module and review access logs for suspicious activity targeting payment endpoints; simultaneously monitor drupal.org/security for SA-CONTRIB-2026-084 patch announcements. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today