Threats tagged 'drupal-contrib-2026-261'

The Drupal Commerce Shipping module has an access bypass vulnerability that allows insufficient protection of shipment references and shipment entity fields. This flaw can lead to unauthorized modification of shipment states or deletion of shipments. Exploitation requires the attacker to have a cart with API-based access, which mitigates the risk to some extent. Fixed versions 2.16.0 and 3.0.6 address this issue.