Commerce Core
Monthly
Missing authorization checks in the Drupal Commerce Core contrib module (2.x releases up to 2.41 and 3.0.0 through 3.3.13) allow forceful browsing, so a remote request can reach an endpoint or operation that the module should have gated behind an access check, yielding limited reads and modifications (CVSS 6.5, C:L/I:L, no availability impact). Drupal contributed-module installs are the exposure surface; sites on other CMS platforms or without Commerce enabled are unaffected. There is no KEV listing and no public exploit identified at time of analysis, and EPSS is low at 0.22% (13th percentile), so the consistent read is a real-but-not-urgent access-control defect; a vendor patch is available, which places this in normal monthly maintenance rather than emergency response.
Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0.
Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
Stored cross-site scripting in Drupal Commerce Core 3.3.0 through 3.3.5 allows an authenticated low-privilege attacker to inject persistent malicious scripts that execute in other users' browsers when affected pages are viewed. The scope change (S:C in the CVSS vector) confirms the payload breaks out of the application's security context into the victim's browser environment, enabling session hijacking or unauthorized UI manipulation. No active exploitation or public exploit code has been identified; EPSS of 0.16% (6th percentile) reflects low real-world exploitation probability at time of analysis.
Missing authorization checks in the Drupal Commerce Core contrib module (2.x releases up to 2.41 and 3.0.0 through 3.3.13) allow forceful browsing, so a remote request can reach an endpoint or operation that the module should have gated behind an access check, yielding limited reads and modifications (CVSS 6.5, C:L/I:L, no availability impact). Drupal contributed-module installs are the exposure surface; sites on other CMS platforms or without Commerce enabled are unaffected. There is no KEV listing and no public exploit identified at time of analysis, and EPSS is low at 0.22% (13th percentile), so the consistent read is a real-but-not-urgent access-control defect; a vendor patch is available, which places this in normal monthly maintenance rather than emergency response.
Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0.
Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
Stored cross-site scripting in Drupal Commerce Core 3.3.0 through 3.3.5 allows an authenticated low-privilege attacker to inject persistent malicious scripts that execute in other users' browsers when affected pages are viewed. The scope change (S:C in the CVSS vector) confirms the payload breaks out of the application's security context into the victim's browser environment, enabling session hijacking or unauthorized UI manipulation. No active exploitation or public exploit code has been identified; EPSS of 0.16% (6th percentile) reflects low real-world exploitation probability at time of analysis.