Threats tagged 'drupal-contrib-2026-301'

The Commerce product alternative module for Drupal allows customers to replace items in their cart with alternative product variations. A vulnerability exists where the module does not verify cart ownership for anonymous visitors, enabling them to view and modify other anonymous visitors' carts. Authenticated users' carts are not affected. A fix is available in version 1.0.1.