Drupal Warns of Critical Commerce Core Flaw Exploited

Drupal has issued a highly critical warning regarding CVE-2026-118539, an access-control flaw in the Commerce Core module currently being exploited. The vulnerability affects versions before 2.41 and 3.0.0 to 3.3.12, allowing unauthenticated attackers to bypass authorization on certain routes and entity fields. Admins of online stores and transaction systems must patch the module immediately and inspect orders for tampering to prevent potential financial consequences resulting from this serious security weakness.