An incorrect authorization vulnerability in Drupal Commerce Shipping allows forceful browsing. This affects Commerce Shipping versions from 0.0.0 to 2.16.0 and from 3.0.0 to 3.0.6. The vulnerability is identified as CVE-2026-118557 and relates to improper access control.