```
Drupal has released fixes for a "highly critical" authorization flaw in its Commerce Core module and warned that attackers are already exploiting it in the wild.
The vulnerability, tracked as CVE-2026-118539, is a missing-authorization bug affecting Commerce Core releases from 0.0.0 through 2.41 and from 3.0.0 through 3.3.13. Drupal's own security advisory — filed under the project's SA series and reported by The Hacker News on 30 October — carries both the affected version ranges and the warning that threat actors are actively leveraging the flaw.
Drupal has rated the issue "highly critical," a label the project uses in place of a published CVSS score; no numerical score has been assigned at the time of writing.
What the module does
Commerce Core is the component that lets Drupal sites sell goods and services through an included shopping cart, which puts the bug squarely on the payment and checkout path for any store built on the platform. A missing-authorization flaw in that context means the application fails to verify whether a request is permitted to perform an action — potentially opening the door to actions on orders, carts, or customer data that an unauthenticated or under-privileged user should not be able to trigger.
Drupal has not published a detailed attack chain, and none should be inferred beyond what the advisory states: the flaw is confirmed, the affected version ranges are fixed, and exploitation is reported as active.
Which versions to move to
The advisory's stated ceilings are 2.41 for the 2.x line and 3.3.13 for the 3.x line. That implies fixed releases land immediately above those boundaries — effectively a 2.42-class and 3.3.14-class patch or later — but those exact version numbers have not yet been officially confirmed by Drupal. Administrators should verify the specific fixed version against Drupal's official SA advisory before upgrading, and should treat any release above the affected ceilings as the target.
What defenders should do
- Inventory your modules. Identify every site running Commerce Core and check its installed version against the affected ranges — including any legacy 2.x deployments that may have been left unmaintained.
- Patch immediately. Update to a release above the affected ceilings as soon as it is available for your site's major version; active exploitation narrows the window for a scheduled maintenance cycle.
- Audit logs for abuse. Review access and order-related logs for anomalous requests that coincide with the disclosure window, and treat any evidence of unauthorized actions as an incident rather than a misconfiguration.
The timing matters for anyone running Drupal for commerce: an authorization bypass in a shopping-cart module is precisely the kind of flaw that gets folded into automated scanning quickly once the affected ranges are public. For Hong Kong IT teams and others managing Drupal deployments, the practical takeaway is a straightforward one — confirm whether Commerce Core is in your stack, check your version against the advisory, and patch without waiting for the next routine update cycle.
```
Drupal 已針對其 Commerce Core 模組中一個「極度嚴重」（highly critical）的授權漏洞發布修復更新，並警告攻擊者已於野外積極利用該漏洞。
是次漏洞編號為 CVE-2026-118539，屬缺少授權檢查（missing-authorization）的缺陷，影響 Commerce Core 由 0.0.0 至 2.41 以及由 3.0.0 至 3.3.13 的所有版本。Drupal 自身的安全公告歸入該專案的 SA 系列，並由 The Hacker News 於 10 月 30 日報道，公告載明受影響版本範圍，同時警告威脅者正積極利用此缺陷。
Drupal 將是次問題評定為「極度嚴重」（highly critical），此級別乃專案用以取代公開 CVSS 評分之標籤；截至撰稿時尚未指派任何數值評分。
該模組的用途
Commerce Core 是令 Drupal 網站可透過內置購物車銷售貨物及服務的組件，這使該漏洞直接落在任何建基於此平台的商店之付款及結賬流程之上。在此情況下，缺少授權檢查的缺陷意味著應用程式未能核實某項請求是否獲准執行某個動作——可能為未經身份驗證或權限不足的用戶開啟操作訂單、購物車或客戶資料的途徑，而這些操作本不應由該等用戶觸發。
Drupal 並未公布詳細的攻擊鏈，且不應就公告所述以外作任何推斷：缺陷已獲確認、受影響版本範圍已有修復版本，且利用行為已報告為正在活躍發生。
應升級至哪些版本
公告所述的版本上限為 2.x 系列的 2.41 及 3.x 系列的 3.3.13。這意味著修復版本應緊接這些界線之上發布——實際上即 2.42 級別及 3.3.14 級別或以上的修補——然而這些具體版本號碼尚未獲 Drupal 正式確認。管理員應在升級前向 Drupal 官方 SA 公告核實具體修復版本，並應以任何高於受影響上限的版本為升級目標。
防護方應採取的措施
- 盤點你的模組。 找出所有營運 Commerce Core 的網站，並核對其已安裝版本是否落在受影響範圍之內——包括任何可能已遭遺忘、長期未維護的 2.x 舊版部署。
- 立即套用修補。 一旦適合你網站主要版本的修復版本發布，應盡快升級至高於受影響上限的版本；由於漏洞正遭積極利用，例行維護週期的等候時間已被壓縮。
- 稽核日誌以防濫用。 檢視存取及訂單相關日誌，查找與漏洞披露時段吻合的異常請求，並應將任何未經授權操作的跡象視為安全事故處理，而非單純設定錯誤。
是次時機對任何以 Drupal 營運電子商務的人士均相當關鍵：購物車模組的授權繞過漏洞，一旦受影響範圍公開，正正就是會迅速被納入自動化掃描工具的缺陷類型。對於香港 IT 團隊及其他管理 Drupal 部署的人員，實際結論相當直接——確認你的技術堆疊中是否包含 Commerce Core、按公告核對你的版本，並即時套用修補，毋須等待下一個例行更新週期。