CVE-2026-118539 Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing.
> This vulnerability is being actively exploited in the wild.
https://www.drupal.org/sa-contrib-2026-254
#drupal #CVE #eitw
ssvc
npub1dv…jfshx
2026-10-30 12:19:06 UTC
Author Public Key
npub1dvrxvdpkggqs4eq5m670khgenxgzqqwmlq8a3kkcru85dsg7e2rsqjfshxSeen on
wss://relay.momostr.pinkPublished at
2026-10-30 12:19:06 UTCEvent JSON
{
"id": "a2bfde24fb84a0bbe7c61b6e6d7086658ae7ceb1ded7f3bcf32b88b8486177af",
"pubkey": "6b0666343642010ae414debcfb5d1999902001dbf80fd8dad81f0f46c11eca87",
"created_at": 1793362746,
"kind": 1,
"tags": [
[
"t",
"eitw"
],
[
"t",
"drupal"
],
[
"proxy",
"https://infosec.exchange/@ssvc/117529820967828196",
"web"
],
[
"t",
"cve"
],
[
"proxy",
"https://infosec.exchange/ap/users/117202824925377048/statuses/117529820967828196",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/ap/users/117202824925377048/statuses/117529820967828196",
"pink.momostr"
],
[
"-"
]
],
"content": "CVE-2026-118539 Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. \n\n\u003e This vulnerability is being actively exploited in the wild.\n\nhttps://www.drupal.org/sa-contrib-2026-254\n\n#drupal #CVE #eitw",
"sig": "9d635803da94601016ae4be0026385033d91dad3fa209903ac35ebb250e36332314e00bdedd01c720cc9a3f0c922afbd210af0155d54e0ae9180d3231f2f9837"
}