CVE-2026-122071: Composer/drupal/commerce_escrow vulnerability

Q: Which deployments should prioritize triage?

Deployments using the composer/drupal/commerce_escrow module to accept Escrow.com payments should prioritize review, because the issue concerns incoming Escrow.com webhook notifications.

Q: What capability does an attacker need to abuse this issue?

An attacker needs to be able to send forged Escrow.com webhook notifications to the affected integration. The supplied information does not identify any authentication requirement or other prerequisite beyond forging those notifications.

Published Nov 4, 2026

Updated

This module enables you to accept payments through Escrow.com with Drupal Commerce.

The module doesn't sufficiently verify incoming Escrow.com webhook notifications. An attacker can forge payment and order status updates, marking unpaid orders as paid or completed, or cancelling orders that are in progress.

Affected Software

1 affected componentFixes available

composer/drupal/commerce_escrow<1.1.0

1.1.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/commerce_escrow to a version that resolves this vulnerability.
Fixed in 1.1.0

Event History

Nov 4, 2026

Advisory Published

via OSV·05:33 PM

Data Sourced

via OSV·05:33 PM

DescriptionAffected Software

Frequently Asked Questions

Which deployments should prioritize triage?

Deployments using the composer/drupal/commerce_escrow module to accept Escrow.com payments should prioritize review, because the issue concerns incoming Escrow.com webhook notifications.

What capability does an attacker need to abuse this issue?

An attacker needs to be able to send forged Escrow.com webhook notifications to the affected integration. The supplied information does not identify any authentication requirement or other prerequisite beyond forging those notifications.