#CVE-2026-118539

Drupal Commerce Shops Hit by Live Attacks on Authorization Flaw

A missing permission check in Drupal Commerce Core lets strangers reach pages they shouldn't. Attackers are already trying it against live stores.