CVE-2026-118539
EPSS 0.2%Active exploitation claimed but not KEV-listed; advisory fresh; no public PoC observed yet.
What: Missing authorization vulnerability in Drupal Commerce Core (versions 0.0–2.41, 3.0–3.3.13) allowing unauthenticated forceful browsing and configuration exposure. CVSS not yet assigned.
Why it matters: Social chatter claims active in-the-wild exploitation and urgent patching, but CVE is not yet KEV-listed. Post #6 conflates this with other KEV entries; post #7 cites SA-CONTRIB-2026-254 as "highly critical" (21/25) with no login required. NVD metadata remains sparse (no CVSS/EPSS), and advisories lack confirmed PoC links. Signal is muddled—claims of active exploitation lack independent corroboration.
Where it's seen: Bluesky posts urging immediate patches to 3.3.13/2.41, trending CVE lists, security aggregators republishing advisory text without new attack data.
RISK: HIGH — Unauthenticated authorization bypass affecting e-commerce platforms; no login required; widespread vendor advisory.
Description
Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.