Active attacks target Drupal Commerce Core authorization flaw

If your Drupal site handles orders or customer accounts, this is the kind of bug that can turn a normal checkout system into an access problem fast. Drupal says attackers are already exploiting a highly critical flaw in Commerce Core.

You do not need a giant online store for this to hurt.

A small shop, a membership site, a charity taking payments, or a company selling one service online can all run on Drupal Commerce. If the software that checks who is allowed to do what gets it wrong, that is not a minor bug. That is the lock on the stockroom door failing.

Drupal has warned that attackers are actively exploiting a highly critical flaw in Commerce Core, tracked as CVE-2026-118539. The issue is described as missing authorization. The affected versions are 0.0.0 to 2.41 and 3.0.0 to 3.3.13. A CVSS score was listed as N/A.

Commerce Core is the part that lets a Drupal site sell goods and services through an included shopping cart. So this is not some obscure add-on with a niche use case. It sits close to money, orders, and customer actions.

Why a missing authorization bug is such a big deal

Authentication answers, "Who are you?"

Authorization answers, "What are you allowed to do?"

That difference sounds small until you picture a hotel. Authentication is showing your room key card at the front desk. Authorization is whether that card opens only your room, or every room, the office, and the safe.

A missing authorization flaw means the application may fail to check whether a user should be allowed to perform an action before it does it.

That can lead to ugly outcomes fast:

• accessing data or functions meant for someone else
• changing orders, carts, or account-related information
• performing administrative or privileged actions without proper rights

Drupal's wording says exploitation is already happening. That shifts this from a routine patching note to an active-risk problem.

Not theoretical. Live.

Why this one deserves immediate attention

The phrase highly critical is doing a lot of work here. Even without a CVSS number, the combination of active exploitation and missing authorization in an e-commerce component is enough to treat this as urgent.

Commerce systems are attractive targets for obvious reasons. They touch customer accounts, purchase flows, business data, and sometimes connected payment operations. Even when card processing is offloaded elsewhere, the store itself still holds useful information and privileged workflows.

And authorization bugs are often sneaky from the outside. A site can look perfectly normal while someone is doing things they should never have been able to do.

That is part of why these flaws are dangerous for smaller organizations too. A lot of teams assume attackers only care about big brands. In practice, opportunistic exploitation often goes after exposed systems at scale. If your site is vulnerable, your company size is not much comfort.

What site owners should do now

If you run Drupal and Commerce Core is in the stack, check the installed version now. The affected ranges listed by Drupal are:

• 0.0.0 to 2.41
• 3.0.0 to 3.3.13

If you are in those ranges, treat it as an immediate patching job.

A few practical steps help:

• identify whether Commerce Core is installed at all
• confirm the exact version in use
• update to the fixed release recommended by Drupal
• review recent administrative and order-related activity for anything unusual
• check user roles and permissions for unexpected changes
• if a web application firewall or access controls are in place, use them as a temporary layer, not as a substitute for patching

If you manage this through an outside developer or hosting provider, send the request with urgency and ask for confirmation of the module version and the remediation timeline.

If you cannot patch immediately, reduce exposure where you can. That can include limiting access to sensitive admin paths, tightening who can log in, and increasing monitoring on account, checkout, and order-management actions. Those are stopgaps, not a fix.

The practical read on this

When a platform says a flaw is highly critical and already being exploited, I would not spend time debating labels.

I would assume attackers are probing for easy wins.

The key idea is simple: this is a permissions failure in software used to run online sales. If those permission checks can be bypassed, an attacker may be able to act outside their lane without needing the kind of break-in people usually imagine.

If your organization uses Drupal Commerce, verify the version, patch fast, and review for suspicious activity right after. Speed matters more than perfect paperwork on this one.