Project:
Project machine name:
commerceDate:
2026-October-28
Vulnerability:
Information disclosure
Affected versions:
<2.41 || >=3.0.0 <3.2.0
CVE IDs:
CVE-2026-118540
Description:
This module enables you to sell goods and services to customers through a shopping cart and checkout form.
When Drupal Commerce is used with the JSON:API module, it is possible for unpublished product variations to be accessible to users without permission.
This vulnerability is mitigated by only affecting sites with published products and unpublished product variations.
Solution:
Install the latest version:
- If you use Commerce Core 3.2.x or lower, upgrade to Commerce Core 3.3.13.
- If you use Commerce Core 8.x upgrade to Commerce Core 8.x-2.41.
Commerce Core 3.3.x is not affected by this vulnerability.
Reported By:
Coordinated By:
- Swan Kalata (akalata) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Mori Sugimoto (dokumori) of the Drupal Security Team
- Neil Drumm (drumm) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
