Drupal Security

Project: CacheFlushProject machine name: cacheflushDate: 2026-October-28Security risk: Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:AllVulnerability: UnsupportedAffected versions: *CVE IDs: CVE-2026-118563Description: 

The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons.

Solution: 

If you use this project, you should uninstall it.

To take over maintainership, read Becoming the maintainer of a project that is unsupported for security reasons.

Reported By: 

• Ivo Van Geertruyen (mr.baileys) of the Drupal Security Team

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Ivo Van Geertruyen (mr.baileys) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team

Project: Single Content SyncProject machine name: single_content_syncDate: 2026-October-28Security risk: Critical 17 ∕ 25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:AllVulnerability: Remote code executionAffected versions: <1.4.19CVE IDs: CVE-2026-118562Description: 

Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites.

A maliciously crafted import file can cause untrusted data to be deserialized, potentially leading to remote code execution.

This vulnerability is mitigated by the fact that an attacker must have a role with the "import single content" permission.

Solution: 

Install the latest version:

• Upgrade to Single Content Sync 1.4.19.

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• Drew Webber (mcdruid) of the Drupal Security Team
• Oleksandr Kuzava (nginex)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Lee Rowlands (larowlan) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Single Content SyncProject machine name: single_content_syncDate: 2026-October-28Security risk: Critical 17 ∕ 25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:AllVulnerability: External control of file name or pathAffected versions: <1.4.19CVE IDs: CVE-2026-118561Description: 

Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites.

The module does not sufficiently validate file sources and destinations during content imports. An attacker can write arbitrary files, disclose sensitive local files accessible to the web server, or cause the server to make requests to internal or external resources. Depending on the server configuration, this may lead to remote code execution.

Exploitation requires the import single content permission. This permission is marked as restricted starting with version 1.4.18. Remote code execution additionally depends on the server permitting execution of attacker-controlled files.

Solution: 

Install the latest version:

• If you use the Single Content Sync module, upgrade to Single Content Sync 1.4.19.

Run database updates and rebuild caches after upgrading. Review the module permissions and ensure only highly trusted roles have the "import single content" permission.

Remote file downloads during imports are disabled by default. Sites that require this functionality must configure trusted file hosts in the module settings. Alternatively, import ZIP files containing the required assets.

Reported By: 

• jvdkolk
• killianacc
• Kévin Le lostec (klelostec)
• nicocha30

Fixed By: 

• killianacc
• Oleksandr Kuzava (nginex)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: AI (Artificial Intelligence)Project machine name: aiDate: 2026-October-28Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Cross-site scriptingAffected versions: <1.4.11 || >=1.5.0 <1.5.2CVE IDs: CVE-2026-118553Description: 

The AI module includes a submodule, AI Automator. This submodule allows you to automatically fill out fields using AI, based on other fields.

The module doesn't sufficiently check access to text formats, allowing users to author field data in text formats they should not have access to.

Solution: 

Install the latest version:

• If you use the AI module 1.5.x, upgrade to AI 1.5.2.
• If you use the AI module 1.4.x, upgrade to AI 1.4.11.
• If you use the AI module 1.3.x, upgrade to AI 1.5.2 or AI 1.4.11 as the 1.3.x branch is now unsupported.

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Artem Dmitriiev (a.dmitriiev)
• Abhisek Mazumdar (abhisekmazumdar)
• Ahmad Khader (ahmad khader)
• Marcus Johansson (marcus_johansson)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: AI (Artificial Intelligence)Project machine name: aiDate: 2026-October-28Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross-site scriptingAffected versions: <1.4.11 || >=1.5.0 <1.5.2CVE IDs: CVE-2026-118552Description: 

This module provides a framework for integrating AI providers and features into Drupal.

The module doesn't sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability.

Solution: 

Install the latest version:

• If you use version 1.5.x, upgrade to AI 1.5.2.
• If you use version 1.4.x, upgrade to AI 1.4.11.
• If you use version 1.3.x, upgrade to AI 1.5.2 or AI 1.4.11 as the 1.3.x branch is now unsupported.

Reported By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Fixed By: 

• Artem Dmitriiev (a.dmitriiev)
• Ahmad Khader (ahmad khader)
• Marcus Johansson (marcus_johansson)
• Valery Lourie (valthebald)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: AI (Artificial Intelligence)Project machine name: aiDate: 2026-October-28Security risk: Less critical 8 ∕ 25 AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Information DisclosureAffected versions: <1.4.11 || >=1.5.0 <1.5.2CVE IDs: CVE-2026-118551Description: 

This module provides a framework for integrating AI providers and features into Drupal.

Audio for every speech-to-text request is written to the same file in the temporary directory and does not delete it afterwards. As a result, an attacker who can read the site's temporary directory could get the audio that another user sent for transcription.

This vulnerability is mitigated by the fact that the attacker needs read access to the temporary directory, either through the server (for example a shared hosting account) or through a module or custom code that exposes temporary files to other users. Drupal core's system.temporary route only serves temporary files to the user who owns them.

Solution: 

Install the latest version:

• If you use version 1.5.x, upgrade to AI 1.5.2.
• If you use version 1.4.x, upgrade to AI 1.4.11.
• If you use version 1.3.x, upgrade to AI 1.5.2 or AI 1.4.11 as the 1.3.x branch is now unsupported.

The fix keeps the audio in memory and no longer writes it to the temporary directory. Site owners may also want to delete any leftover speech_to_text.mp3 file in the temporary directory.

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Artem Dmitriiev (a.dmitriiev)
• Abhisek Mazumdar (abhisekmazumdar)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: AI (Artificial Intelligence)Project machine name: aiDate: 2026-October-28Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: <1.4.11 || >=1.5.0 <1.5.2CVE IDs: CVE-2026-118550Description: 

This module provides a framework for integrating Drupal with AI providers. Its AI Search submodule provides a Search API backend that stores content in a vector database for semantic search.

The AI Search submodule has always been marked as 'experimental' but more importantly is deprecated. You may wish to use this as an opportunity to move to the standalone AI Search which is a drop-in replacement and target of all new development. It also had the same vulnerability.

The AI Search backend checks access to each search result for the current user, but this is not taken into account when Search API caches the results of a view. As a result, cached search results, including titles and other displayed fields of unpublished or access-restricted content, can be shown to users who do not have access to that content in some configurations.

This vulnerability is mitigated by the fact that:

• The AI Search submodule must be enabled and used with a Search API view.
• The view must use Search API result caching ("Search API (time-based)", "Search API (tag-based)" or "Search API (time and tag-based)"). The default, "Search API (none)", is not affected.
• A user with access to the restricted content must have run the same search within the cache lifetime.

Retrieval-augmented generation (RAG) tools, AI Assistant RAG actions and custom code running Search API queries are not affected.

Solution: 

Install the latest version:

• If you use the AI module 1.5.x with the AI Search submodule, upgrade to AI 1.5.2
• If you use the AI module 1.4.x with the AI Search submodule, upgrade to AI 1.4.11
• If you use the AI module 1.3.x with the AI Search submodule, upgrade to AI 1.5.2 or AI 1.4.11 as the 1.3.x branch is now unsupported.
• If you use the AI Search 1.3.x standalone module, upgrade to AI 1.3.0-alpha6
• If you use the AI Search 2.0.x standalone module, upgrade to AI 2.0.0-alpha3

Reported By: 

• Marcus Johansson (marcus_johansson)
• Scott Euser (scott_euser)

Fixed By: 

• Artem Dmitriiev (a.dmitriiev)
• Scott Euser (scott_euser)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: AI (Artificial Intelligence)Project machine name: aiDate: 2026-October-28Security risk: Critical 15 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross-site scriptingAffected versions: <1.4.11 || >=1.5.0 <1.5.2CVE IDs: CVE-2026-118549Description: 

This AI module enables you to interact with AI providers. It has a service that helps any consumer of the module to stop cross site scripting elements from appearing.

The module does not sufficiently validate Markdown links under certain conditions, potentially allowing cross-site scripting (XSS).

Solution: 

Install the latest version:

• If you use version 1.5.x, upgrade to AI 1.5.2.
• If you use version 1.4.x, upgrade to AI 1.4.11
• If you use version 1.3.x, upgrade to AI 1.5.2 or AI 1.4.11 as the 1.3.x branch is now unsupported.

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Artem Dmitriiev (a.dmitriiev)
• Abhisek Mazumdar (abhisekmazumdar)
• Ahmad Khader (ahmad khader)
• Marcus Johansson (marcus_johansson)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: AI (Artificial Intelligence)Project machine name: aiDate: 2026-October-28Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:DefaultVulnerability: Information disclosureAffected versions: <1.4.11 || >=1.5.0 <1.5.2CVE IDs: CVE-2026-118548Description: 

This module enables you to use AI on the website. It also enables you to interact with AI providers.

The module does not sufficiently validate links under certain conditions, potentially allowing the exfiltration of sensitive information to external sites.

This vulnerability is mitigated by the fact that an attacker must use untrusted sources when interacting with the AI module in a way that produces rendered HTML.

Solution: 

Install the latest version:

• If you use version 1.5.x, upgrade to AI 1.5.2
• If you use version 1.4.x, upgrade to AI 1.4.11
• If you use version 1.3.x, upgrade to AI 1.5.2 or AI 1.4.11 as the 1.3.x branch is now unsupported.

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Artem Dmitriiev (a.dmitriiev)
• Ahmad Khader (ahmad khader)
• Marcus Johansson (marcus_johansson)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: AI (Artificial Intelligence)Project machine name: aiDate: 2026-October-28Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross-site scriptingAffected versions: <1.4.11 || >=1.5.0 <1.5.2CVE IDs: CVE-2026-118546Description: 

This module enables you to use AI on the website. It includes an AI Chatbot submodule allows you to setup a chatbot.

Under certain configurations, the chatbot does not sufficiently filter user input before rendering it, potentially allowing cross-site scripting (XSS).

This vulnerability is mitigated by the fact that an attacker must have access to administer blocks.

Solution: 

Install the latest version:

• If you use version 1.5.x, upgrade to AI 1.5.2.
• If you use version 1.4.x, upgrade to AI 1.4.11.
• If you use version 1.3.x, upgrade to AI 1.5.2 or AI 1.4.11 as the 1.3.x branch is now unsupported.

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Artem Dmitriiev (a.dmitriiev)
• Abhisek Mazumdar (abhisekmazumdar)
• Ahmad Khader (ahmad khader)
• Marcus Johansson (marcus_johansson)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: AI (Artificial Intelligence)Project machine name: aiDate: 2026-October-28Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross-site scriptingAffected versions: <1.4.11 || >=1.5.0 <1.5.2CVE IDs: CVE-2026-118545Description: 

This module enables you to use AI on the website.

The module does not sufficiently restrict HTML rendering, allowing cross-site scripting (XSS) under certain conditions.

This vulnerability is mitigated by the fact that an attacker must have access to a text format that can render HTML.

Solution: 

Install the latest version:

• If you use the AI module 1.5.x, upgrade to AI 1.5.2
• If you use the AI module 1.4.x, upgrade to AI 1.4.11
• If you use the AI module 1.3.x, upgrade to AI 1.5.2 or AI 1.4.11 as the 1.3.x branch is now unsupported.

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Artem Dmitriiev (a.dmitriiev)
• Abhisek Mazumdar (abhisekmazumdar)
• Ahmad Khader (ahmad khader)
• Marcus Johansson (marcus_johansson)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Commerce StripeProject machine name: commerce_stripeDate: 2026-October-28Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross site scriptingAffected versions: >=2.0.0 <2.2.3CVE IDs: CVE-2026-118560Description: 

This module enables you to use the Stripe Connect API to quickly configure your Drupal Commerce store to take payments via multiple Stripe APIs.

Under certain rare circumstances, the module may expose a cross-site scripting vulnerability.

This vulnerability is mitigated by the fact that an attacker must have administrator permissions to configure payment gateways and use the Stripe Connect in conjunction with the compromise of an external service.

Solution: 

Install the latest version:

• Upgrade to Commerce Stripe 2.2.3.
• Commerce Stripe 2.0.x and 2.1.x are no longer supported, so sites on older versions should also update to Commerce Stripe 2.2.3.
• Commerce Stripe 8.x-1.x is not affected.

Reported By: 

• Brian Willows (hsjbrianwillows)

Fixed By: 

• Ryan Szrama (rszrama)
• Tom Ashe (tomtech)
• Jonathan Sacksick (jsacksick)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Commerce StripeProject machine name: commerce_stripeDate: 2026-October-28Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:DefaultVulnerability: Improper verification of cryptographic signatureAffected versions: <1.4 || >=2.0.0 <2.2.3CVE IDs: CVE-2026-118559Description: 

This module enables you to take payments via multiple Stripe APIs.

The module doesn't sufficiently verify the cryptographic signature of a webhook event when a signing secret has not been properly configured in the payment gateway settings.

This vulnerability is mitigated by the fact that not all payment gateway plugins in the module utilize webhooks. Furthermore, any payment gateway configuration with any value for its webhook signing secret will prevent inappropriate processing.

Solution: 

Install the latest version:

• Upgrade to Commerce Stripe 2.2.3.
• Commerce Stripe 2.0.x and 2.1.x are no longer supported, so sites on older versions should also update to Commerce Stripe 2.2.3.
• If you use Commerce Stripe 8.x-1.3 or earlier, upgrade to Commerce Stripe 8.x-1.4.

Reported By: 

• Brian Willows (hsjbrianwillows)

Fixed By: 

• Ryan Szrama (rszrama)
• Tom Ashe (tomtech)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Commerce StripeProject machine name: commerce_stripeDate: 2026-October-28Security risk: Critical 15 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross-site request forgeryAffected versions: >=2.0.0 <2.2.3CVE IDs: CVE-2026-118558Description: 

This module enables you to use the Stripe Connect API to quickly configure your Drupal Commerce store to take payments via multiple Stripe APIs.

When redirecting to Stripe Connect to generate an authorization code, the module does not incorporate a CSRF token into the return URI. This could allow a an attacker to trick an administrator to click a link that bypasses Stripe payment for an order, meaning that the order would be marked as paid without any actual payment.

Solution: 

Install the latest version:

• Upgrade to Commerce Stripe 2.2.3.
• Commerce Stripe 2.0.x and 2.1.x are no longer supported, so sites on older versions should also update to Commerce Stripe 2.2.3.
• Commerce Stripe 8.x-1.x is not affected.

Reported By: 

• Brian Willows (hsjbrianwillows)

Fixed By: 

• Ryan Szrama (rszrama)
• Tom Ashe (tomtech)
• Jonathan Sacksick (jsacksick)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Commerce ShippingProject machine name: commerce_shippingDate: 2026-October-28Security risk: Less critical 8 ∕ 25 AC:Basic/A:Admin/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: <2.16.0 || >=3.0.0 <3.0.6CVE IDs: CVE-2026-118557Description: 

This module enables you to sell tangible products via Drupal Commerce that are organized into shipments for fulfillment.

The module doesn't sufficiently check access on the form to resend receipts. Under certain configurations, this allows some users to gain access to receipts and customer information for orders they should not be able to access.

Solution: 

Install the latest version:

• If you use Commerce Shipping 3.0.x, upgrade to Commerce Shipping 3.0.6.
• If you use Commerce Shipping 8.x-2.x, upgrade to Commerce Shipping 8.x-2.16.

Reported By: 

• Jakub Piasecki (zaporylie)

Fixed By: 

• Jonathan Sacksick (jsacksick)
• Jakub Piasecki (zaporylie)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Commerce ShippingProject machine name: commerce_shippingDate: 2026-October-28Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: <2.16.0 || >=3.0.0 <3.0.6CVE IDs: CVE-2026-118556Description: 

This module enables you to sell tangible products via Drupal Commerce that are organized into shipments for fulfillment.

The module doesn't sufficiently protect shipment references and shipment entity fields, leading to an access bypass that can result in inappropriately modified shipment states or deleted shipments.

This vulnerability is mitigated by the fact that an attacker must have a cart with API-based access to manipulate its shipments.

Solution: 

Install the latest version:

• If you use Commerce Shipping 3.0.x, upgrade to Commerce Shipping 3.0.6.
• If you use Commerce Shipping 8.x-2.x, upgrade to Commerce Shipping 8.x-2.16.

Reported By: 

• Jakub Piasecki (zaporylie)

Fixed By: 

• Jonathan Sacksick (jsacksick)
• Jakub Piasecki (zaporylie)
• Tom Ashe (tomtech)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Commerce LicenseProject machine name: commerce_licenseDate: 2026-October-28Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: <3.1.1CVE IDs: CVE-2026-118555Description: 

This module enables you to sell licenses granting access to resources, such as user roles, files, or protected content.

The module doesn't sufficiently restrict access to license fields for users with the "update own commerce_license" permission. A license owner can change the rights granted by their license and the license state, which can result in privilege escalation, up to the Administrator role for the site.

This vulnerability is mitigated by the fact that an attacker must own a license, and have a role with the "update own commerce_license" permission, which is not granted by default.

Solution: 

Install the latest version:

• If you use the Commerce License module for Drupal 10 or 11, upgrade to Commerce License 3.1.1.

Sites that granted the "update own commerce_license" permission should review role licenses for unexpected roles, and review which users hold administrative roles.

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Jonathan Sacksick (jsacksick)
• Tom Ashe (tomtech)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Commerce CoreProject machine name: commerceDate: 2026-October-28Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Proof/TD:UncommonVulnerability: Information disclosureAffected versions: <2.41.0 || >=3.0.0 <3.3.13CVE IDs: CVE-2026-118544Description: 

This module enables you to sell goods and services to customers through a shopping cart and checkout form.

The module doesn't sufficiently restrict the product variations returned by entity queries to the variations the current user can view. When the core JSON:API module is enabled, a visitor can make repeated requests that eventually determine certain field values on an unpublished product variation, or a variation of an unpublished product.

This vulnerability is mitigated by the fact that the core JSON:API module must be enabled.

Solution: 

Install the latest version:

• If you use Commerce 3.x, upgrade to Commerce 3.3.13
• If you use Commerce 2.x, upgrade to Commerce 8.x-2.41

Reported By: 

• Marcus Johansson

Fixed By: 

• Jonathan Sacksick (jsacksick)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Commerce CoreProject machine name: commerceDate: 2026-October-28Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross-site request forgeryAffected versions: <2.41.0 || >=3.0.0 <3.3.13CVE IDs: CVE-2026-118543Description: 

This module enables you to sell goods and services to customers through a shopping cart and checkout form. It shows an inbox on the Commerce dashboard with announcements from the Drupal Commerce project, including notices about security updates.

Routes for the inbox do not check for a CSRF token. As a result, an attacker can trick a user with the "access commerce administration pages" permission into visiting a crafted page that will dismiss notifications for the messages. The inbox is also shared by all users, so if one commerce administrator is tricked, this hides the messages from every administrator, including notices that a security update is available.

Solution: 

Install the latest version:

• If you use version 3.x, upgrade to Commerce Core 3.3.13.
• If you use an earlier version, upgrade to Commerce Core 8.x-2.41.

Reported By: 

• Marcus Johansson (marcus_johansson)
• Ivo Van Geertruyen (mr.baileys) of the Drupal Security Team

Fixed By: 

• Jakub Piasecki (zaporylie)
• Jonathan Sacksick (jsacksick)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Commerce CoreProject machine name: commerceDate: 2026-October-28Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:Admin/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <2.41.0 || >=3.0.0 <3.3.13CVE IDs: CVE-2026-118542Description: 

This module enables you to sell goods and services to customers through a shopping cart and checkout form. Sites can also create multiple online stores that are managed by different users.

The module doesn't check access properly when a store is saved. A user who can either create stores or edit their own store is able to mark their store as the site's default store. This causes their store to get some orders they normally shouldn't.

Only sites that give those permissions to untrusted users are affected (for example, marketplace sites where vendors manage their own stores).

Solution: 

Install the latest version:

• If you use version 3.x, upgrade to Commerce Core 3.3.13.
• If you use an earlier version, upgrade to Commerce Core 8.x-2.41.

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Jonathan Sacksick (jsacksick)
• Tom Ashe (tomtech)
• Jakub Piasecki (zaporylie)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team