CVE-2026-96378: Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179

Published Oct 22, 2026

Updated

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce Decoupled Checkout allows Object Injection. This issue affects Commerce Decoupled Checkout versions: from 1.0.0 to 1.8.0.

Event History

Oct 22, 2026

CVE Published

via MITRE·01:21 AM

Data Sourced

via MITRE·01:21 AM

DescriptionWeakness

Frequently Asked Questions

Which installations are affected?

Commerce Decoupled Checkout versions from 1.0.0 through 1.8.0 are affected.

What type of impact does this issue enable?

The vulnerability is an access bypass caused by improperly controlled modification of dynamically determined object attributes, allowing object injection.

CVE-2026-96378: Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179

Event History

Frequently Asked Questions

Which installations are affected?

What type of impact does this issue enable?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What type of impact does this issue enable?