Search

Find a vulnerability

Search criteria

    Related vulnerabilities

    DRUPAL-CONTRIB-2026-179 (CVE-2026-96378)

    Vulnerability from drupal – Published: 2026-09-23 17:06 – Updated: 2026-09-23 17:06 – Source website
    VLAI
    Details

    This module enables REST endpoints for a decoupled Commerce experience which allow for remote order creation.

    The module doesn't sufficiently sanitize order data passed into the order creation endpoint, which allows for potentially unsafe order properties to be set on an order.

    Credits
    Marcus Johansson (marcus_johansson) www.drupal.org/u/marcus_johansson
    References
    To clipboard 

    {
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003e=1.0.0 \u003c1.8.0"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/commerce_decoupled_checkout"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003e=1.0.0 \u003c1.8.0"
          },
          "events": [
            {
              "introduced": "1.0.0"
            },
            {
              "fixed": "1.8.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [
    "CVE-2026-96378"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/u/marcus_johansson"
      ],
      "name": "Marcus Johansson (marcus_johansson)"
    }
  ],
  "details": "This module enables REST endpoints for a decoupled Commerce experience which allow for remote order creation.\n\nThe module doesn\u0027t sufficiently sanitize order data passed into the order creation endpoint, which allows for potentially unsafe order properties to be set on an order.",
  "id": "DRUPAL-CONTRIB-2026-179",
  "modified": "2026-09-23T17:06:19.000Z",
  "published": "2026-09-23T17:06:19.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-179"
    }
  ],
  "schema_version": "1.7.0"
}