DRUPAL-CONTRIB-2026-258: CSRF

Q: Who can be targeted by this issue?

An attacker must trick a user who has the "access commerce administration pages" permission into visiting a crafted page. The direct effect is dismissal of Commerce dashboard inbox notifications.

Q: Does exploiting one administrator account affect other administrators?

Yes. The Commerce inbox is shared by all users, so notifications dismissed through one targeted commerce administrator are hidden from every administrator.

Q: What is the practical security impact?

The issue can suppress Commerce project announcements, including notifications that a security update is available. It does not describe unauthorized access to the shopping cart, checkout process, or other Commerce administration functions.

Q: How can administrators tell whether they may have been affected?

Administrators may observe that expected announcements or security-update notices are absent from the Commerce dashboard inbox. The provided information does not identify a separate audit indicator or recovery procedure.

Published Oct 28, 2026

Updated

This module enables you to sell goods and services to customers through a shopping cart and checkout form. It shows an inbox on the Commerce dashboard with announcements from the Drupal Commerce project, including notices about security updates.

Routes for the inbox do not check for a CSRF token. As a result, an attacker can trick a user with the "access commerce administration pages" permission into visiting a crafted page that will dismiss notifications for the messages. The inbox is also shared by all users, so if one commerce administrator is tricked, this hides the messages from every administrator, including notices that a security update is available.

Affected Software

2 affected componentsFixes available

composer/drupal/commerce<2.41.0

2.41.0

composer/drupal/commerce>=3.0.0<3.3.13

3.3.13

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/commerce to a version that resolves this vulnerability.
Fixed in 2.41.0
Upgrade
Upgrade composer/drupal/commerce to a version that resolves this vulnerability.
Fixed in 3.3.13

Event History

Oct 28, 2026

Advisory Published

via OSV·04:55 PM

Data Sourced

via OSV·04:55 PM

DescriptionAffected Software

Frequently Asked Questions

Who can be targeted by this issue?

An attacker must trick a user who has the "access commerce administration pages" permission into visiting a crafted page. The direct effect is dismissal of Commerce dashboard inbox notifications.

Does exploiting one administrator account affect other administrators?

Yes. The Commerce inbox is shared by all users, so notifications dismissed through one targeted commerce administrator are hidden from every administrator.

What is the practical security impact?

The issue can suppress Commerce project announcements, including notifications that a security update is available. It does not describe unauthorized access to the shopping cart, checkout process, or other Commerce administration functions.

How can administrators tell whether they may have been affected?

Administrators may observe that expected announcements or security-update notices are absent from the Commerce dashboard inbox. The provided information does not identify a separate audit indicator or recovery procedure.

DRUPAL-CONTRIB-2026-258: CSRF

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can be targeted by this issue?

Does exploiting one administrator account affect other administrators?

What is the practical security impact?

How can administrators tell whether they may have been affected?

Company

Resources

Contact

Frequently Asked Questions

Who can be targeted by this issue?

Does exploiting one administrator account affect other administrators?

What is the practical security impact?

How can administrators tell whether they may have been affected?