EUVD-2026-43062
GHSA-2q62-xm7g-h9gh
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-accessible web module with no auth needed, but AC:H reflects required endpoint knowledge; C:L/I:L reflects bounded payment-data exposure with no availability impact.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
6DescriptionCVE.org
Incorrect Authorization vulnerability in Drupal Commerce Realex / Global Payments allows Forceful Browsing. This issue affects Commerce Realex / Global Payments versions: from 0.0.0 to 3.0.2.
AnalysisAI
Incorrect Authorization (CWE-863) in the Drupal Commerce Realex / Global Payments module exposes protected payment and order resources to forceful browsing, allowing unauthenticated remote attackers to access endpoints that should require authorization. All module versions from 0.0.0 through 3.0.2 (exclusive) are affected on Drupal Commerce deployments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target site must be running the Drupal Commerce Realex / Global Payments module in versions 0.0.0 through 3.0.2 (exclusive). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Multiple signals converge on a moderate-to-low real-world priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker targeting a Drupal e-commerce site identifies that it uses the Commerce Realex / Global Payments module, then enumerates or constructs the URL paths for protected payment confirmation or order-status endpoints. Without holding a user session or any credentials, the attacker directly browses to those paths, triggering the missing authorization check and gaining access to order details or potentially influencing transaction state. … |
| Remediation | Upgrade the Commerce Realex / Global Payments module to version 3.0.2 or later, as confirmed available by the vendor advisory at https://www.drupal.org/sa-contrib-2026-058. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today