CVE-2026-118539

UNKNOWN

Published 2026-10-30 · Source mlhess@drupal.org

Description

Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.

CWE-862

References

https://www.drupal.org/sa-contrib-2026-254

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-85268
A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versions prior to 2026-08-14 on iOS allows an unauthenticated remote attacker to execute arbitrary JavaScript using a malicious iOS bundle ID.
2026-10-30 · score —
CVE-2026-22114
HTTP basic auth enforces no retry limit or backoff. Combined with the default service password, the keyspace is exhaustible.
2026-10-30 · score —
CVE-2026-22110
The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.
2026-10-30 · score —
CVE-2026-22109
The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit.
2026-10-30 · score —
CVE-2026-22105
Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. An unauthenticated attacker with adjacent network access can reconstruct the resulting password, or exhaust the keyspace, and log in to read and change sensitive settings such as the OCPP backend.
2026-10-30 · score —