Threats tagged 'drupal-contrib-2026-254'

A vulnerability in the Drupal Commerce module allows insufficient protection of certain routes and entity fields, leading to an access bypass. This flaw can financially impact the vendor by enabling unauthorized access to commerce functions. The issue affects versions prior to 2.41.0 and versions from 3.0.0 up to but not including 3.3.13. A fix is available in versions 2.41.0 and 3.3.13. The vulnerability is actively exploited in the wild.