Drupal Commerce Core Authorization Flaws

Missing authorization checks in the Drupal Commerce Core contrib module (2.x releases up to 2.41 and 3.0.0 through 3.3.13) allow forceful browsing, so a remote request can reach an endpoint or operation that the module should have gated behind an access check, yielding limited reads and modifications (CVSS 6.5, C:L/I:L, no availability impact). Drupal contributed-module installs are the exposure surface; sites on other CMS platforms or without Commerce enabled are unaffected. There is no KEV listing and no public exploit identified at time of analysis, and EPSS is low at 0.22% (13th percentile), so the consistent read is a real-but-not-urgent access-control defect; a vendor patch is available, which places this in normal monthly maintenance rather than emergency response.

Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0.

Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.