If your shop runs Drupal Commerce, today is a patch day and tomorrow is an audit day. The Hacker News reports that Drupal has warned of active exploitation of a highly critical missing-authorization flaw in Commerce Core, CVE-2026-118539, affecting versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13. Installing the update closes the gap. It says nothing about what went through that gap while it was open. Checking order, pricing and customer endpoints for abuse that already happened is the kind of review we run on payment and account flows, so message us and you get cost and timeline within a day.
Was this useful?