Commerce Paypal
Monthly
Incorrect authorization in the Drupal Commerce PayPal contribution module (versions up to 1.12.0 and 2.0.0 through 2.1.3) lets remote unauthenticated attackers reach protected resources or actions through forceful browsing - directly requesting URLs/endpoints that should be access-checked. A vendor patch exists via Drupal security advisory SA-contrib-2026-095. No public exploit has been identified at time of analysis, and the module is a niche payment-integration component rather than Drupal core.
Incorrect authorization in the Drupal Commerce PayPal contribution module (versions up to 1.12.0 and 2.0.0 through 2.1.3) lets remote unauthenticated attackers reach protected resources or actions through forceful browsing - directly requesting URLs/endpoints that should be access-checked. A vendor patch exists via Drupal security advisory SA-contrib-2026-095. No public exploit has been identified at time of analysis, and the module is a niche payment-integration component rather than Drupal core.