Threats tagged 'drupal-contrib-2026-258'

The Drupal Commerce module contains a vulnerability where routes for the inbox on the Commerce dashboard do not verify CSRF tokens. This allows an attacker to trick a user with the 'access commerce administration pages' permission into dismissing important notification messages, including security update notices. Since the inbox is shared among all commerce administrators, a successful attack hides these messages from all administrators, potentially delaying critical security updates.