CVE-2026-118556

Low risk· EPSS 4%

Published: 30/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

4th percentile - higher than 4% of all known CVEs

Summary

The Drupal Commerce Shipping module contains an incorrect authorization vulnerability enabling forceful browsing. This issue affects versions from 0.0.0 to 2.16.0 and from 3.0.0 to 3.0.6.

Risk Assessment

An attacker could bypass access control mechanisms and access protected shipping-related resources, potentially resulting in data disclosure or unauthorized changes. This affects the confidentiality and integrity of the system.

Recommendation

Update the Commerce Shipping module to a version later than 2.16.0 or 3.0.6. Verify permission configuration and restrict access to sensitive paths.

Other vulnerabilities in Drupal Commerce Shipping

CVE-2026-118557Low risk· EPSS 3%
The Drupal Commerce Shipping module has an incorrect authorization vulnerability that allows forceful browsing of unauthorized resources. This issue affects versions from 0.0.0 to 2.16.0 and from 3.0.0 to 3.0.6.

Original NVD description (English source)

Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS