GoKawiilDrupal patches actively exploited Commerce Core access bypass flaw
Drupal issued a highly critical advisory for CVE-2026-118539, a missing-authorization bug in its Commerce Core module that lets unauthenticated attackers bypass access controls. The flaw affects Commerce Core versions 0.0.0-2.41 and 3.0.0-3.3.13, and Drupal says it is already being exploited. Admins are urged to update to 3.3.13 or 8.x-2.41 and review order records for signs of tampering.