CVE-2026-118543
Received Received - Intake

Cross-Site Request Forgery in Drupal Commerce Core

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: Drupal.org

Description
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-118543
EUVD
EUVD-2026-113514

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Drupal Commerce Core 0.0.0
Drupal Commerce Core 3.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core. It allows attackers to trick users into executing unwanted actions on a web application where they are authenticated, potentially leading to unauthorized state changes.

Impact Analysis

An attacker could exploit this to perform actions on your behalf without your consent, such as modifying orders, changing account settings, or making unauthorized purchases if you are logged into a vulnerable Drupal Commerce site.

Mitigation Strategies

Update Drupal Commerce Core to a version outside the affected range (2.41.0 or 3.3.13 and above). Disable or restrict access to administrative functions if updates cannot be applied immediately.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118543. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart