Threats tagged 'drupal-contrib-2026-257'

A vulnerability in the Drupal Commerce module allows users with permissions to create or edit their own stores to improperly mark their store as the site's default store. This improper access control can cause the affected store to receive orders it should not normally get. The issue affects sites that grant such permissions to untrusted users, such as marketplaces where vendors manage their own stores. Fixed versions are 2.41.0 and 3.3.13.