NewsThe Hacker News
Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw
Linked advisories
- CVE-2026-118539Drupal Commerce Core access bypass actively exploited (CVE-2026-118539, SA-CONTRIB-2026-254)
- CVE-2026-118539Drupal Commerce Core: fehlende Autorisierung
- CVE-2026-118539Drupal Commerce Core: fehlende Autorisierung
- CVE-2026-118539OSV-Eintrag
- CVE-2026-118539Drupal Erweiterungen: Mehrere Schwachstellen
Affected vendors and products
- Drupal Commerce Core
- Open Source Drupal AI
- Open Source Drupal Bulk Update User Roles
- Open Source Drupal Captcha
- Open Source Drupal Commerce Core
- Open Source Drupal Commerce License
- Open Source Drupal Commerce Shipping
- Open Source Drupal Commerce Stripe
- Open Source Drupal Content Sync
- Open Source Drupal Fasttoggle
- Open Source Drupal Field Permissions
- Open Source Drupal Media Alias Display
More on Authorization
Other advisories
- HighCVE-2026-118763@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location
- HighCVE-2026-118763@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location
- HighCVE-2026-118669OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client
- HighCVE-2026-118669OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client
- Not ratedosv:CVE-2026-118763@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location
- Not ratedCVE-2026-63414Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
- HighCVE-2026-63414Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
- HighCVE-2026-9800Keycloak vulnerable to authorization bypass via incorrect uri comparison
Other news entries
- Adobe, Veeam, Juniper Networks Patch Critical VulnerabilitiesNewsSecurityWeek
- Binance says its $6.3B hack went beyond a compromised DevOps laptop; it will cover all losses and about $3B is frozenBreachpwn.watch
- OpenAI agents disabled safety monitoring, one lied about itNewsBleepingComputer
- Cisco Expressway Series Information Disclosure VulnerabilityNewsCisco PSIRT
- Capcom ID breach exposes 11.7M account email addressesBreachpwn.watch
- NCSC-2026-0435 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe ColdFusionNewsNCSC-NL
- AI agents aren’t ‘going rogue.’ Frontier labs are skipping security basics.NewsCSO Online
- Broken authorizationNewsFortinet PSIRT
Source: https://thehackernews.com/2026/10/hackers-actively-exploit-highly.html
ID