Threats tagged 'drupal-contrib-2026-256'

A vulnerability in the Drupal Commerce module allows users with permission to manage their own promotions to delete or modify coupons belonging to other promotions due to insufficient access checks on the relationship between promotions and coupons. This issue requires that the site accepts writes via JSON:API or REST, which is not enabled by default, mitigating the risk. Fixed versions 2.41.0 and 3.3.13 address this vulnerability.