SA-CONTRIB-2026-300: Critical severity composer/drupal/basket_paypal vulnerability

Q: Who is exposed to this issue?

Sites using the composer/drupal/basket_paypal module and accepting PayPal webhook requests are exposed. The issue affects payment records that an attacker can reference in a crafted webhook request.

Q: What does an attacker need to exploit it?

An attacker does not need authentication. They need to submit a crafted PayPal webhook request that references a payment record.

Q: What is the impact of successful exploitation?

The associated order can be marked as paid even though no payment was completed.

Published Nov 4, 2026

Updated

The AlternativeCommerce PayPal Checkout module provides an AlternativeCommerce method to embed payment services from PayPal. The module does not sufficiently validate incoming PayPal webhook requests. An unauthenticated attacker can submit a crafted request that references a payment record, causing the associated order to be marked as paid without completing a payment.

Credit

Marcus Johansson (marcus_johansson)

Affected Software

1 affected componentFixes available

composer/drupal/basket_paypal<1.1.1

1.1.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/basket_paypal to a version that resolves this vulnerability.
Fixed in 1.1.1

Event History

Nov 4, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-122069

Frequently Asked Questions

Who is exposed to this issue?

Sites using the composer/drupal/basket_paypal module and accepting PayPal webhook requests are exposed. The issue affects payment records that an attacker can reference in a crafted webhook request.

What does an attacker need to exploit it?

An attacker does not need authentication. They need to submit a crafted PayPal webhook request that references a payment record.

What is the impact of successful exploitation?

The associated order can be marked as paid even though no payment was completed.

SA-CONTRIB-2026-300: Critical severity composer/drupal/basket_paypal vulnerability

Credit

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?