CVE-2026-118539Drupal Commerce Core access bypass (CVE-2026-118539) exploited to place fraudulent orders

Executive summary

On 2026-10-28 the Drupal Security Team published SA-CONTRIB-2026-254 for Commerce Core, rated "Highly critical" (21/25). The module does not sufficiently protect certain routes and entity fields, allowing an attacker to bypass access controls. The CVE record (CVE-2026-118539) classifies it as CWE-862 Missing Authorization. Drupal states the flaw is being actively exploited in the wild and may financially impact the store owner.

Centarro, the maintainer of Drupal Commerce, reported on 2026-10-29 that two merchants saw attempts to place fraudulent orders on live sites, including items priced at $0.01. As of that post, Centarro and the Drupal Security Team had found no evidence of broader or scripted abuse. Commerce Core is reported to be used on more than 42,000 sites.

Fixed releases are Commerce Core 3.3.13 (3.x) and 8.x-2.41 (2.x). Because exploitation targets order data (prices, adjustments, payment state) rather than the host, response is primarily patching plus a business-level order audit reconciled against payment provider records.

Threat assessment

The Drupal risk vector (AC:None/A:None/CI:Some/II:Some/E:Exploit/TD:All) means no special access or authentication is required, an exploit exists, and all configurations are affected. Centarro states that sites using JSON:API have been exploitable since 8.x-2.18 (2020-05-26) and all other sites since 8.x-2.25 (2021-06-30), so the exposure window for unpatched stores spans years.

Confirmed impact so far is financial fraud on individual stores (unpaid or underpriced orders) rather than code execution or data theft. Drupal and Centarro have not published technical exploit details, attacker infrastructure or attribution. CISA's ADP enrichment in the CVE record scores the issue CVSS 3.1 6.5 (Medium) and, as of 2026-10-30, lists SSVC Exploitation as "none"; the vendor confirmation of active exploitation takes precedence for prioritisation. The CVE was not in the CISA KEV catalog as of catalog version 2026.11.06.

Priority for SOC/IR teams: any internet-facing Drupal Commerce store below the fixed versions, especially headless or decoupled shops exposing JSON:API write operations. Stores that fulfil orders automatically on checkout completion without confirming payment carry the highest loss risk.

Timeline

1. 2026-11-06

   CISA KEV catalog version 2026.11.06 does not list CVE-2026-118539. Source

2. 2026-11-03

   Commerce Core 3.3.14 released. Source

3. 2026-10-31

   CVE record updated with CISA ADP enrichment: CVSS 3.1 6.5 (Medium), SSVC Exploitation "none" (timestamp 2026-10-30). Source

4. 2026-10-30

   CVE-2026-118539 published (CWE-862 Missing Authorization); press coverage by SecurityWeek and BleepingComputer. Source

5. 2026-10-29

   Centarro reports two merchants saw fraudulent order attempts (including $0.01 items) and publishes order-audit guidance and SQL checks. Source

6. 2026-10-28

   Drupal SA-CONTRIB-2026-254 (Highly critical, 21/25) states the flaw is actively exploited in the wild. Source

7. 2026-10-28

   Commerce Core 3.3.13 and 8.x-2.41 released, fixing SA-CONTRIB-2026-254 and five further Commerce Core advisories. Source

8. 2021-06-30

   Commerce Core 8.x-2.25 released; per Centarro, non-JSON:API sites are exploitable from this version. Source

9. 2020-05-26

   Commerce Core 8.x-2.18 released; per Centarro, JSON:API sites are exploitable from this version. Source

Affected & exposure

Drupal Commerce Core (drupal/commerce) 3.0.0 up to but excluding 3.3.13

Drupal Commerce Core releases before 8.x-2.41

Per Centarro: sites using JSON:API exploitable since 8.x-2.18; all other sites since 8.x-2.25

Both full-stack and headless/decoupled deployments (attack vectors differ by architecture, per Centarro)

Exploitation in the wild

Drupal states in SA-CONTRIB-2026-254 that the vulnerability "is being actively exploited in the wild" and that sites should audit their orders for inconsistencies.

Centarro (2026-10-29): two merchants reported attempts to place fraudulent orders on live sites; reported orders included items priced at $0.01 alongside normally priced items.

Centarro and the Drupal Security Team reported no evidence of broader or scripted abuse as of 2026-10-29. No IOCs (IP addresses, user agents, hashes) have been published.

Exploitation requires no authentication according to the Drupal risk vector. Technical details of the affected routes and entity fields have not been disclosed.

Detection & hunting

No network IOCs have been published. Detection relies on web access logs and on the order-level indicators described by Centarro: placed orders that did not pass through checkout, paid orders without payment entities, overridden unit prices and unexplained "custom" adjustments. Centarro notes that legitimate orders should trace back to requests on /checkout/ paths, so correlating order timestamps and client IPs with access logs is the core hunt. The queries below are generic hunting starting points and need tuning to your log schema and to legitimate API clients.

index=web sourcetype IN ("access_combined","nginx:plus:access","apache:access")
| where method IN ("POST","PATCH","DELETE")
| where like(uri_path, "/jsonapi/commerce_order%") OR like(uri_path, "/jsonapi/commerce_order_item%")
| stats count AS writes, values(method) AS methods, values(status) AS statuses, earliest(_time) AS first_seen, latest(_time) AS last_seen BY clientip, http_user_agent
| convert ctime(first_seen) ctime(last_seen)
| sort - writes
``` Review sources that are not known integrations or decoupled frontends ```

index=web sourcetype IN ("access_combined","nginx:plus:access","apache:access") earliest=-30d
| eval is_checkout=if(like(uri_path, "/checkout/%"), 1, 0)
| eval is_commerce_write=if(method IN ("POST","PATCH") AND (like(uri_path, "/jsonapi/commerce_%") OR like(uri_path, "/cart%")), 1, 0)
| stats sum(is_checkout) AS checkout_hits, sum(is_commerce_write) AS commerce_writes BY clientip
| where commerce_writes > 0 AND checkout_hits = 0
``` Cross-check these IPs against order IP addresses and timestamps from the Centarro SQL audit ```

title: Write Request to Drupal Commerce JSON:API Order Resource
status: experimental
description: Hunting rule for POST/PATCH/DELETE requests to Drupal Commerce order or order item JSON:API resources. Related to CVE-2026-118539 (SA-CONTRIB-2026-254) order manipulation. Expect legitimate hits from decoupled frontends and integrations.
references:
  - https://www.drupal.org/sa-contrib-2026-254
  - https://www.centarro.io/blog/update-drupal-commerce-sites-exploit-observed-wild
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - 'POST'
      - 'PATCH'
      - 'DELETE'
  selection_uri:
    cs-uri-stem|contains:
      - '/jsonapi/commerce_order/'
      - '/jsonapi/commerce_order_item/'
  condition: selection_method and selection_uri
falsepositives:
  - Decoupled storefronts and back-office integrations using JSON:API
level: medium
tags:
  - attack.initial-access
  - attack.t1190

Mitigation

• Upgrade Commerce Core to 3.3.13 (3.x) or 8.x-2.41 (2.x) immediately; 3.3.14 was released on 2026-11-03. Run database updates and clear caches after deployment, then confirm the installed version.
• Also apply the security releases Centarro lists for Commerce API, Commerce License, Commerce Shipping and Commerce Stripe.
• If JSON:API update operations are not required, switch JSON:API to read-only until the update is deployed (Centarro).
• Audit recent orders per Centarro guidance: placed orders not at checkout step "complete" with a positive balance, orders whose total paid exceeds completed payments, order items with overridden_unit_price set, and adjustments with source ID "custom". Reconcile against payment provider transactions before correcting anything.
• Preserve evidence (database snapshot, order history, web/proxy logs, payment provider records) before remediation and match suspicious order IPs/timestamps against access logs.
• Do not fulfil orders based only on placement or checkout completion; confirm full payment first.
• Plan migration from 8.x-2.x to 3.x; Centarro states 8.x-2.x support ends with the release of Drupal 12.

Update log

Sources

1. Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254
2. Commerce Core 3.3.13 release
3. Centarro: Update Drupal Commerce sites, exploit observed in the wild
4. CVE-2026-118539 record (CVE List V5)
5. CISA Known Exploited Vulnerabilities catalog (cisagov/kev-data mirror)
6. SecurityWeek: Drupal Commerce Core vulnerability exploited against online stores
7. BleepingComputer: Drupal warns of critical Commerce Core flaw exploited in attacks
8. SecurityOnline: Drupal Commerce vulnerability CVE-2026-118539 exploited