CVE-2026-118543
Low risk· EPSS 2%Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A Cross-Site Request Forgery (CSRF) vulnerability in the Drupal Commerce Core module allows unauthorized actions to be performed on behalf of a logged-in user. The issue affects versions from 0.0.0 to 2.41.0 and from 3.0.0 to 3.3.13.
Risk Assessment
An attacker could trick a user into performing unwanted operations, such as changing data or making transactions. The risk applies to organizations using vulnerable versions of Commerce Core.
Recommendation
Update the Drupal Commerce Core module to a version later than 2.41.0 or 3.3.13. Implement CSRF protection mechanisms if not already in place.
Other vulnerabilities in Drupal Commerce Core
See all- CVE-2026-118544Low risk· EPSS 4%
An Exposure of Sensitive Information Through Data Queries vulnerability in the Drupal Commerce Core module allows Forceful Browsing. The issue affects versions from 0.0.0 to 2.41.0 and from 3.0.0 to 3.3.13.
- CVE-2026-118542Low risk· EPSS 4%
An Incorrect Authorization vulnerability in the Drupal Commerce Core module allows Forceful Browsing. The issue affects versions from 0.0.0 to 2.41.0 and from 3.0.0 to 3.3.13.
- CVE-2026-118541Low risk· EPSS 4%
An Incorrect Authorization vulnerability in the Drupal Commerce Core module allows Forceful Browsing. The issue affects versions from 0.0.0 to 2.41.0 and from 3.0.0 to 3.3.13.
- CVE-2026-118540Low risk· EPSS 4%
An Incorrect Authorization vulnerability in the Drupal Commerce Core module allows Forceful Browsing. The issue affects versions from 0.0.0 to 2.41 and from 3.0.0 to 3.2.0.
- CVE-2026-118539Medium
A Missing Authorization vulnerability in the Drupal Commerce Core module allows Forceful Browsing. The issue affects versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13.
- CVE-2026-10769Medium
A Stored Cross-Site Scripting (XSS) vulnerability was found in Drupal Commerce Core due to improper input neutralization during page generation. It affects versions from 3.3.0 to 3.3.6.
Original NVD description (English source)
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS