Threats tagged 'drupal-contrib-2026-259'

The Drupal Commerce module has a vulnerability where it does not properly restrict product variations returned by entity queries to those viewable by the current user. When the core JSON:API module is enabled, an attacker can make repeated requests to infer certain field values of unpublished product variations or variations of unpublished products. This issue affects versions prior to 2.41.0 and versions from 3.0.0 up to but not including 3.3.13. A fix is available in versions 2.41.0 and 3.3.13.