DRUPAL-CONTRIB-2026-262: Composer/drupal/commerce_shipping vulnerability

Q: What conditions make an installation vulnerable?

The affected module must be used with a configuration in which users can reach the receipt-resend form without appropriate access checks. The advisory describes the issue as occurring only under certain configurations.

Q: What information could unauthorized users obtain?

Users who should not have access to an order may be able to access its receipts and associated customer information.

Q: How can administrators determine whether they are affected?

Review whether composer/drupal/commerce_shipping is installed and whether any user roles can access the form used to resend receipts. Verify that those roles are authorized to view the relevant orders and customer information.

Published Oct 28, 2026

Updated

This module enables you to sell tangible products via Drupal Commerce that are organized into shipments for fulfillment.

The module doesn't sufficiently check access on the form to resend receipts. Under certain configurations, this allows some users to gain access to receipts and customer information for orders they should not be able to access.

Affected Software

2 affected componentsFixes available

composer/drupal/commerce_shipping<2.16.0

2.16.0

composer/drupal/commerce_shipping>=3.0.0<3.0.6

3.0.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/commerce_shipping to a version that resolves this vulnerability.
Fixed in 2.16.0
Upgrade
Upgrade composer/drupal/commerce_shipping to a version that resolves this vulnerability.
Fixed in 3.0.6

Event History

Oct 28, 2026

Advisory Published

via OSV·04:56 PM

Data Sourced

via OSV·04:56 PM

DescriptionAffected Software

Frequently Asked Questions

What conditions make an installation vulnerable?

The affected module must be used with a configuration in which users can reach the receipt-resend form without appropriate access checks. The advisory describes the issue as occurring only under certain configurations.

What information could unauthorized users obtain?

Users who should not have access to an order may be able to access its receipts and associated customer information.

How can administrators determine whether they are affected?

Review whether composer/drupal/commerce_shipping is installed and whether any user roles can access the form used to resend receipts. Verify that those roles are authorized to view the relevant orders and customer information.

DRUPAL-CONTRIB-2026-262: Composer/drupal/commerce_shipping vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions make an installation vulnerable?

What information could unauthorized users obtain?

How can administrators determine whether they are affected?

Company

Resources

Contact

Frequently Asked Questions

What conditions make an installation vulnerable?

What information could unauthorized users obtain?

How can administrators determine whether they are affected?