EUVD-2026-69993
GHSA-828j-363w-82c9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Drupal store using Commerce PayPal
-
DeliveryEnumerate protected module endpoints
-
ExploitDirectly request resource lacking authz check
-
ExecutionAccess order/payment data or action
-
ImpactData exposure or unauthorized change
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a Drupal site running Drupal Commerce with the Commerce PayPal module installed at an affected version (≤1.12.0 or 2.0.0-2.1.3) and reachable over the network. Per the CVSS vector no authentication, no special configuration, and no user interaction are needed (PR:N/UI:N/AC:L), so any internet-exposed vulnerable storefront is at risk. The primary limiting factor is deployment scope: only sites that actually enable the PayPal payment integration (not Drupal core or Commerce alone) are affected, and the exact protected resources reachable via forceful browsing are not detailed in the advisory. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, base 9.1) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality and integrity impact and no availability impact - a serious profile on paper. However, the description is terse ('allows Forceful Browsing') and gives no detail on exactly what data or actions are exposed, so the I:H rating is plausibly overstated for what is typically a read-oriented authorization gap; C:H is the more defensible claim. No EPSS score, KEV listing, or POC was provided, so there is no signal of active or imminent exploitation - this reads as a real-but-not-emergency patch-soon issue rather than a mass-exploited threat. The 'Authentication Bypass' tag conflicts with the CWE-863 classification: this is broken authorization (access to resources despite lacking rights), not authentication bypass; treat the tag as a mislabel when routing/triaging. |
| Exploit ScenarioDerived | An attacker enumerates the Drupal site's Commerce PayPal routes and directly requests a protected endpoint or resource that the module fails to authorize, retrieving payment/order data or triggering a payment-related action without holding the required permissions. No authentication and no user interaction are required (AV:N/PR:N/UI:N), so the request can be scripted against any exposed vulnerable store. No public POC has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Incorrect authorization in the Drupal Commerce PayPal contribution module (versions up to 1.12.0 and 2.0.0 through 2.1.3) lets remote unauthenticated attackers reach protected resources or actions through forceful browsing - directly requesting URLs/endpoints that should be access-checked. A vendor patch exists via Drupal security advisory SA-contrib-2026-095. No public exploit has been identified at time of analysis, and the module is a niche payment-integration component rather than Drupal core.
RemediationAI
Patch available per vendor advisory - upgrade to the fixed releases in the 1.x and 2.x branches referenced by Drupal SA-contrib-2026-095 (https://www.drupal.org/sa-contrib-2026-095); the 2.x fix supersedes 2.1.3 and the 1.x fix supersedes 1.12.0 (apply the exact fixed version listed on the advisory for your branch). Because the module handles PayPal payment callbacks and order flows, prioritize this on live storefronts. If immediate upgrade is not possible, restrict access to the module's routes at the reverse proxy/web-server layer (e.g. limit exposure of the affected endpoints and PayPal IPN/return callback paths to expected PayPal source ranges), and review web logs for anomalous direct requests to those paths; note the trade-off that over-restricting PayPal callback URLs can break legitimate payment notifications, so validate any allowlist against PayPal's documented IP ranges before enforcing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Commerce PayPal module for Drupal Commerce (CPE cpe:2.3:a:drupal:commerce_paypal), which integrates PayPal payment flows into Drupal-based storefronts. The root cause is CWE-863 (Incorrect Authorization): the code performs an authorization check that is missing, incomplete, or logically wrong on one or more routes/handlers, so access-control is not correctly enforced. This manifests as 'forceful browsing' - an attacker enumerates or directly requests protected paths/parameters and the application serves them because the authorization gate is bypassable or absent, rather than because authentication was defeated.
Know when Commerce Paypal gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network forceful browsing (AV:N/AC:L/PR:N/UI:N) exposes protected payment/order data (C:H); integrity lowered to I:L since read-access authorization gaps rarely grant full modification.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
4DescriptionCVE.org
Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3.
Executive ViewAI
Drupal Commerce PayPal module versions through 1.12.0 and 2.0.0-2.1.3 contain an authorization flaw allowing unauthenticated attackers to bypass payment endpoint authentication controls. Organizations running affected versions face direct risk to payment transaction integrity and exposure of sensitive payment configuration and order data. This affects any e-commerce deployment relying on this PayPal integration for payment processing.
Apply vendor patch per Drupal security advisory SA-contrib-2026-095. Pending patch deployment, restrict direct HTTP/HTTPS access to payment administration endpoints using Web Application Firewall (WAF) rules or network access control lists; closely monitor payment endpoint access logs and authentication attempts for signs of unauthorized access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB