Commerce Decoupled Checkout CVE-2026-96378

Exploitation targets the Drupal Commerce Decoupled Checkout contrib module (versions 1.0.0 up to but not including the fix at 1.8.0) and, per the CVSS vector, requires user interaction (UI:R) while needing no authentication (PR:N) and no elevated privileges. The exact feature, endpoint, or input that carries the injected object is not described in the available sources, so the precise configuration prerequisite cannot be stated beyond 'the module must be installed and handling checkout requests.' Limiting factors: required victim interaction, the narrow deployment footprint of this specific Drupal contrib module, and a vendor-assigned impact confined to limited integrity (C:N/A:N) reduce realistic risk below the raw unauthenticated/network framing.

This is a moderate-severity, lower-priority issue by the aggregated signals. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, base 4.3) describes an unauthenticated, network-reachable, low-complexity flaw that nevertheless requires user interaction and yields only limited integrity impact with no confidentiality or availability loss. EPSS is 0.42% (35th percentile), i.e. low predicted exploitation probability, and the vuln.today Decision label is 'this_month' rather than act_now/emergency - consistent with a flaw worth patching on a normal cycle, not an emergency. There is no CISA KEV listing and no public exploit identified at time of analysis (the only Drupal reference is the vendor security advisory SA-contrib-2026-179, not working exploit code). A notable tension: the CWE (CWE-915, improper modification of dynamically-determined object attributes) and the 'Object Injection' / 'Code Injection' framing often imply the potential for code execution, yet the vendor-assigned impact is only I:L with C:N/A:N - verify with the Drupal advisory whether exploitation is genuinely limited to constrained integrity effects or whether the scoring understates a deserialization-to-RCE path. The trigger mechanism is not described in the available sources, so the UI:R requirement cannot be attributed to a specific interaction. Overall: a real but non-urgent priority given low EPSS, no KEV, no PoC, limited impact, and a required user action.

A remote, unauthenticated attacker crafts malicious serialized/object data and induces a victim to submit or trigger a decoupled-checkout request that carries it; the module improperly controls modification of dynamically-determined object attributes, allowing object injection that tampers with application state (limited integrity impact). No public exploit code has been identified, and the exact trigger is not described in the available sources.