–
Not scored
CVE-2026-118556
Commerce Shipping - Moderately critical - Access bypass - SA-CONTRIB-2026-261
Commerce Shipping · Incorrect authorization · CWE-863AffectedCommerce Shipping
FixUpdate to 2.16.0, 3.0.6 or newer
PublishedOct 30, 03:09 · drupal
ScoredNot yet
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:10 UTC
What we know
No known exploitation. CISA KEV, checked 22:10 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
No severity score yet.
Description
Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.
From drupal
Affected and fixed versions
ProductAffectedFixed inCommerce Shipping0.0.0 – before 2.16.02.16.0Commerce Shipping3.0.0 – before 3.0.63.0.6
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known