EUVD-2026-69993
GHSA-828j-363w-82c9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network forceful browsing (AV:N/AC:L/PR:N/UI:N) exposes protected payment/order data (C:H); integrity lowered to I:L since read-access authorization gaps rarely grant full modification.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
5DescriptionCVE.org
Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3.
AnalysisAI
Incorrect authorization in the Drupal Commerce PayPal contribution module (versions up to 1.12.0 and 2.0.0 through 2.1.3) lets remote unauthenticated attackers reach protected resources or actions through forceful browsing - directly requesting URLs/endpoints that should be access-checked. A vendor patch exists via Drupal security advisory SA-contrib-2026-095. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a Drupal site running Drupal Commerce with the Commerce PayPal module installed at an affected version (≤1.12.0 or 2.0.0-2.1.3) and reachable over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, base 9.1) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality and integrity impact and no availability impact - a serious profile on paper. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory - upgrade to the fixed releases in the 1.x and 2.x branches referenced by Drupal SA-contrib-2026-095 (https://www.drupal.org/sa-contrib-2026-095); the 2.x fix supersedes 2.1.3 and the 1.x fix supersedes 1.12.0 (apply the exact fixed version listed on the advisory for your branch). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Begin immediately by identifying all Drupal Commerce installations with PayPal module versions 1.12.0 or earlier, or 2.0.0 through 2.1.3 in use; this audit should complete within 24 hours and focus on customer-facing production environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today