What is the CVSS score of EUVD-2026-43062?

EUVD-2026-43062 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-43062?

Yes, a patch is available for EUVD-2026-43062. Update the affected software to the latest version immediately.

Commerce Realex / Global Payments EUVD-2026-43062

| CVE-2026-13238 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-10 drupal

GHSA-2q62-xm7g-h9gh

Authentication Bypass Drupal Commerce Realex Global Payments

4.8

CVSS 3.1 · Vendor: drupal

Severity by source

Vendor (drupal) PRIMARY

4.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

4.8 MEDIUM

Network-accessible web module with no auth needed, but AC:H reflects required endpoint knowledge; C:L/I:L reflects bounded payment-data exposure with no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (drupal).

CVSS VectorVendor: drupal

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 21:18 vuln.today

Severity Changed

Jul 13, 2026 - 19:22 NVD

CRITICAL MEDIUM

CVSS changed

Jul 13, 2026 - 19:22 NVD

9.1 (CRITICAL) 4.8 (MEDIUM)

CVSS changed

Jul 13, 2026 - 19:07 NVD

9.1 (CRITICAL)

Patch available

Jul 10, 2026 - 23:02 EUVD

CVE Published

Jul 10, 2026 - 21:44 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Incorrect Authorization vulnerability in Drupal Commerce Realex / Global Payments allows Forceful Browsing. This issue affects Commerce Realex / Global Payments versions: from 0.0.0 to 3.0.2.

AnalysisAI

Incorrect Authorization (CWE-863) in the Drupal Commerce Realex / Global Payments module exposes protected payment and order resources to forceful browsing, allowing unauthenticated remote attackers to access endpoints that should require authorization. All module versions from 0.0.0 through 3.0.2 (exclusive) are affected on Drupal Commerce deployments. No public exploit code has been identified and SSVC confirms no active exploitation at time of analysis, though the nature of a payment gateway module means successful access could expose order or transaction data.

Technical ContextAI

The affected component is the Drupal Commerce integration module for the Realex Payments / Global Payments gateway, identified by CPE cpe:2.3:a:drupal:commerce_realex_/_global_payments:*:*:*:*:*:*:*:*. CWE-863 (Incorrect Authorization) describes a failure to correctly verify that a requester is authorized to access a resource, distinct from authentication failures. The 'Forceful Browsing' descriptor indicates the module does not enforce authorization checks on one or more URL-addressable endpoints - an attacker who knows or guesses these paths can reach them directly without holding a valid session or role. In a payment gateway context, such endpoints may include order confirmation pages, payment return/callback handlers, or transaction status lookups, making improper access more impactful than in a generic content module.

RemediationAI

Upgrade the Commerce Realex / Global Payments module to version 3.0.2 or later, as confirmed available by the vendor advisory at https://www.drupal.org/sa-contrib-2026-058. Drupal module updates can be applied via Composer (composer update drupal/commerce_realex) or through the Drupal administrative update interface. If immediate patching is not feasible, a compensating control is to restrict access to the payment module's callback and confirmation URL paths at the web server or reverse proxy layer using IP allowlisting for known payment gateway IP ranges from Realex / Global Payments - this limits the network exposure while degrading operational flexibility. An alternative is to temporarily disable the module and revert to manual order processing, though this has significant business impact. No generic workarounds are available that fully mitigate the authorization bypass without restricting module functionality.