CVE-2026-15089

CriticalCVSS 9.1

Published: 10/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.51%

40th percentile - higher than 40% of all known CVEs

Summary

A vulnerability in the Drupal Commerce guest registration module allows unauthorized access. This issue affects all versions of the module.

Risk Assessment

An attacker can exploit the vulnerability to bypass guest registration mechanisms, leading to unauthorized access to user accounts and potential data leakage.

Recommendation

Immediately update the Drupal Commerce guest registration module to the latest available version or apply temporary mitigations such as disabling guest registration until a patch is released.

Original NVD description (English source)

vulnerability in Drupal Commerce guest registration allows . This issue affects Commerce guest registration versions: *.*.