Search

Find a vulnerability

Search criteria

    4 vulnerabilities found for Commerce Shipping by Drupal

    CVE-2026-118557 (GCVE-0-2026-118557)

    Vulnerability from nvd – Published: 2026-10-30 03:09 – Updated: 2026-10-30 03:09
    VLAI
    Title
    Commerce Shipping - Less critical - Access bypass - SA-CONTRIB-2026-262
    Summary
    Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.
    Severity
    No CVSS data available.
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    drupal CNA under the mitre root
    CNA scorecard D 53/100 over 279 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Drupal Commerce Shipping Affected: 0.0.0 , < 2.16.0 (semver)
    Affected: 3.0.0 , < 3.0.6 (semver)
    		Create a notification for this product.
    Date Public
    2026-10-28 16:56
    Credits
    Jakub Piasecki (zaporylie) Jonathan Sacksick (jsacksick) Jakub Piasecki (zaporylie) Swan Kalata (akalata) Greg Knaddison (greggles) Juraj Nemec (poker10) Jess (xjm)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/commerce_shipping",
          "product": "Commerce Shipping",
          "repo": "https://git.drupalcode.org/project/commerce_shipping",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "2.16.0",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.0.6",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakub Piasecki (zaporylie)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jonathan Sacksick (jsacksick)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jakub Piasecki (zaporylie)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Swan Kalata (akalata)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-10-28T16:56:34.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-87",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-87 Forceful Browsing"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T03:09:04.516Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-262"
        }
      ],
      "title": "Commerce Shipping - Less critical - Access bypass - SA-CONTRIB-2026-262"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-118557",
    "datePublished": "2026-10-30T03:09:04.516Z",
    "dateReserved": "2026-10-28T15:50:46.719Z",
    "dateUpdated": "2026-10-30T03:09:04.516Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-118556 (GCVE-0-2026-118556)

    Vulnerability from nvd – Published: 2026-10-30 03:09 – Updated: 2026-10-30 03:09
    VLAI
    Title
    Commerce Shipping - Moderately critical - Access bypass - SA-CONTRIB-2026-261
    Summary
    Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.
    Severity
    No CVSS data available.
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    drupal CNA under the mitre root
    CNA scorecard D 53/100 over 279 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Drupal Commerce Shipping Affected: 0.0.0 , < 2.16.0 (semver)
    Affected: 3.0.0 , < 3.0.6 (semver)
    		Create a notification for this product.
    Date Public
    2026-10-28 16:56
    Credits
    Jakub Piasecki (zaporylie) Jonathan Sacksick (jsacksick) Jakub Piasecki (zaporylie) Tom Ashe (tomtech) Swan Kalata (akalata) Greg Knaddison (greggles) Juraj Nemec (poker10) Jess (xjm)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/commerce_shipping",
          "product": "Commerce Shipping",
          "repo": "https://git.drupalcode.org/project/commerce_shipping",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "2.16.0",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.0.6",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakub Piasecki (zaporylie)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jonathan Sacksick (jsacksick)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jakub Piasecki (zaporylie)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Tom Ashe (tomtech)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Swan Kalata (akalata)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-10-28T16:56:24.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-87",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-87 Forceful Browsing"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T03:09:05.585Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-261"
        }
      ],
      "title": "Commerce Shipping - Moderately critical - Access bypass - SA-CONTRIB-2026-261"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-118556",
    "datePublished": "2026-10-30T03:09:05.585Z",
    "dateReserved": "2026-10-28T15:50:46.718Z",
    "dateUpdated": "2026-10-30T03:09:05.585Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-118556 (GCVE-0-2026-118556)

    Vulnerability from cvelistv5 – Published: 2026-10-30 03:09 – Updated: 2026-10-30 03:09
    VLAI
    Title
    Commerce Shipping - Moderately critical - Access bypass - SA-CONTRIB-2026-261
    Summary
    Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.
    Severity
    No CVSS data available.
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    drupal CNA under the mitre root
    CNA scorecard D 53/100 over 279 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Drupal Commerce Shipping Affected: 0.0.0 , < 2.16.0 (semver)
    Affected: 3.0.0 , < 3.0.6 (semver)
    		Create a notification for this product.
    Date Public
    2026-10-28 16:56
    Credits
    Jakub Piasecki (zaporylie) Jonathan Sacksick (jsacksick) Jakub Piasecki (zaporylie) Tom Ashe (tomtech) Swan Kalata (akalata) Greg Knaddison (greggles) Juraj Nemec (poker10) Jess (xjm)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/commerce_shipping",
          "product": "Commerce Shipping",
          "repo": "https://git.drupalcode.org/project/commerce_shipping",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "2.16.0",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.0.6",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakub Piasecki (zaporylie)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jonathan Sacksick (jsacksick)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jakub Piasecki (zaporylie)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Tom Ashe (tomtech)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Swan Kalata (akalata)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-10-28T16:56:24.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-87",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-87 Forceful Browsing"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T03:09:05.585Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-261"
        }
      ],
      "title": "Commerce Shipping - Moderately critical - Access bypass - SA-CONTRIB-2026-261"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-118556",
    "datePublished": "2026-10-30T03:09:05.585Z",
    "dateReserved": "2026-10-28T15:50:46.718Z",
    "dateUpdated": "2026-10-30T03:09:05.585Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-118557 (GCVE-0-2026-118557)

    Vulnerability from cvelistv5 – Published: 2026-10-30 03:09 – Updated: 2026-10-30 03:09
    VLAI
    Title
    Commerce Shipping - Less critical - Access bypass - SA-CONTRIB-2026-262
    Summary
    Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.
    Severity
    No CVSS data available.
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    drupal CNA under the mitre root
    CNA scorecard D 53/100 over 279 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Drupal Commerce Shipping Affected: 0.0.0 , < 2.16.0 (semver)
    Affected: 3.0.0 , < 3.0.6 (semver)
    		Create a notification for this product.
    Date Public
    2026-10-28 16:56
    Credits
    Jakub Piasecki (zaporylie) Jonathan Sacksick (jsacksick) Jakub Piasecki (zaporylie) Swan Kalata (akalata) Greg Knaddison (greggles) Juraj Nemec (poker10) Jess (xjm)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/commerce_shipping",
          "product": "Commerce Shipping",
          "repo": "https://git.drupalcode.org/project/commerce_shipping",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "2.16.0",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.0.6",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakub Piasecki (zaporylie)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jonathan Sacksick (jsacksick)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jakub Piasecki (zaporylie)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Swan Kalata (akalata)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-10-28T16:56:34.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-87",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-87 Forceful Browsing"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T03:09:04.516Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-262"
        }
      ],
      "title": "Commerce Shipping - Less critical - Access bypass - SA-CONTRIB-2026-262"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-118557",
    "datePublished": "2026-10-30T03:09:04.516Z",
    "dateReserved": "2026-10-28T15:50:46.719Z",
    "dateUpdated": "2026-10-30T03:09:04.516Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}