SA-CONTRIB-2026-179: Critical severity drupal/commerce_decoupled_checkout vulnerability
This module enables REST endpoints for a decoupled Commerce experience which allow for remote order creation. The module doesn't sufficiently sanitize order data passed into the order creation endpoint, which allows for potentially unsafe order properties to be set on an order.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/commerce_decoupled_checkoutto a version that resolves this vulnerability.Fixed in 8.x-1.8
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using the Drupal Commerce Decoupled Checkout module and its remote order-creation REST endpoints are exposed.
What does an attacker need to exploit it?
An attacker needs to submit order data to the order-creation endpoint. The issue is caused by insufficient sanitization of data passed to that endpoint.
What could indicate that a site has already been affected?
Review orders created through the remote order-creation endpoint for unexpected or unsafe order property values.