SA-CONTRIB-2026-256: Critical severity composer/drupal/commerce vulnerability

Q: Who is realistically exposed to this issue?

Sites using composer/drupal/commerce are exposed only if they accept write operations through JSON:API or REST. Those write interfaces are not enabled by default, which mitigates the issue.

Q: What level of access would an attacker need?

The attacker would need an account permitted to manage its own promotions and access to a JSON:API or REST write path. With that access, they could change or delete coupons associated with other promotions.

Q: Are default installations affected?

The vulnerable behavior requires JSON:API or REST writes, and those are not enabled by default. A site that has not enabled such write access has this mitigation in place.

Published Oct 28, 2026

Updated

This module enables you to sell goods and services to customers through a shopping cart and checkout form. It includes a feature to manage promotions and the coupons that apply them. The module doesn't sufficiently check access to the relationship between promotions and coupons. A user who is only allowed to manage their own promotions can delete or change coupons that belong to other promotions. This vulnerability is mitigated by the fact that the site must accept writes through JSON:API or REST, which is not enabled by default.

Credit

Marcus Johansson (Marcus_Johansson)

Affected Software

1 affected componentFixes available

composer/drupal/commerce<3.3.13, <8.x-2.41

3.3.138.x-2.41

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/commerce to a version that resolves this vulnerability.
Fixed in 3.3.13Fixed in 8.x-2.41

Event History

Oct 28, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-118541

Frequently Asked Questions

Who is realistically exposed to this issue?

Sites using composer/drupal/commerce are exposed only if they accept write operations through JSON:API or REST. Those write interfaces are not enabled by default, which mitigates the issue.

What level of access would an attacker need?

The attacker would need an account permitted to manage its own promotions and access to a JSON:API or REST write path. With that access, they could change or delete coupons associated with other promotions.

Are default installations affected?

The vulnerable behavior requires JSON:API or REST writes, and those are not enabled by default. A site that has not enabled such write access has this mitigation in place.

SA-CONTRIB-2026-256: Critical severity composer/drupal/commerce vulnerability

Credit

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is realistically exposed to this issue?

What level of access would an attacker need?

Are default installations affected?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What level of access would an attacker need?

Are default installations affected?