SA-CONTRIB-2026-255: Critical severity composer/drupal/commerce vulnerability

Q: Which sites are affected by this issue?

The issue affects Drupal Commerce sites that also use the JSON:API module and have published products with unpublished product variations. Sites without that combination are mitigated.

Q: Who could access the unpublished product variations?

Users without permission may be able to access unpublished product variations through JSON:API when the affected product and variation publication state combination exists.

Published Oct 28, 2026

Updated

This module enables you to sell goods and services to customers through a shopping cart and checkout form. When Drupal Commerce is used with the JSON:API module, it is possible for unpublished product variations to be accessible to users without permission. This vulnerability is mitigated by only affecting sites with published products and unpublished product variations.

Credit

Matt Glaman (mglaman)

Affected Software

1 affected componentFixes available

composer/drupal/commerce<3.3.13, <8.x-2.41

3.3.138.x-2.41

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/commerce to a version that resolves this vulnerability.
Fixed in 3.3.13Fixed in 8.x-2.41

Event History

Oct 28, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-118540

Frequently Asked Questions

Which sites are affected by this issue?

The issue affects Drupal Commerce sites that also use the JSON:API module and have published products with unpublished product variations. Sites without that combination are mitigated.

Who could access the unpublished product variations?

Users without permission may be able to access unpublished product variations through JSON:API when the affected product and variation publication state combination exists.

SA-CONTRIB-2026-255: Critical severity composer/drupal/commerce vulnerability

Credit

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which sites are affected by this issue?

Who could access the unpublished product variations?

Company

Resources

Contact

Frequently Asked Questions

Which sites are affected by this issue?

Who could access the unpublished product variations?