CVE-2026-118556 in Commerce Shipping
Summary
by MITRE • 10/30/2026
Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The identified security flaw within the Drupal Commerce Shipping module represents a critical failure in access control mechanisms, specifically categorized under CWE-284 Improper Access Control and often associated with ATT&CK technique T1078 Valid Accounts if exploited by authenticated users or T1190 Exploit Public-Facing Application when targeting unauthenticated vectors. This vulnerability manifests as an instance of forceful browsing, also known as insecure direct object reference (IDOR), where the application fails to adequately verify that a user has the necessary permissions to access specific resources or execute certain actions via HTTP requests. In the context of Drupal Commerce Shipping, which manages shipping methods, rates, and configurations for e-commerce stores, this lack of authorization enforcement allows attackers to manipulate parameters in API calls or administrative endpoints to view, modify, or delete sensitive configuration data that should be restricted to users with elevated privileges such as administrators or specialized commerce managers.
The technical root cause lies in the module's handling of input validation during requests related to shipping configurations. When a user interacts with features like editing shipping methods or viewing rate tables, the backend logic likely relies on client-supplied identifiers without performing sufficient server-side checks against the current session’s permission set. This oversight enables an attacker to craft malicious URLs or API payloads that reference objects belonging to other users or system-level defaults. By systematically iterating through these object references, a threat actor can bypass intended access boundaries, effectively gaining unauthorized visibility into store-wide shipping settings which may include proprietary carrier credentials, pricing logic, and tax calculation rules. This behavior is particularly dangerous in multi-tenant environments or when administrative interfaces are exposed to the public internet without additional protective layers like Web Application Firewalls that might detect such enumeration patterns.
The operational impact of this vulnerability extends beyond mere data leakage. If an attacker successfully exploits this forceful browsing capability, they can alter shipping configurations to disrupt business operations. For instance, by modifying rate tables or disabling specific carriers, the attacker could cause checkout failures for legitimate customers, leading to direct revenue loss and reputational damage. Furthermore, access to sensitive configuration details might reveal integration points with third-party logistics providers, potentially exposing API keys or authentication tokens that could be leveraged in subsequent attacks against those external services. In severe cases, if the affected endpoints allow write operations without proper authorization checks, an attacker could inject malicious shipping rules that manipulate order totals or redirect shipments, compromising the integrity of the entire commerce workflow.
Mitigation strategies must prioritize immediate remediation through software updates and robust access control implementation. The primary defense is to upgrade Drupal Commerce Shipping to a version outside the affected ranges, specifically ensuring usage of versions 2.17.0 or later for the 2.x branch and 3.0.7 or later for the 3.x branch, where these authorization checks have been corrected by the development team. For organizations unable to patch immediately due to compatibility constraints with other modules, temporary mitigations should include restricting access to administrative paths using IP whitelisting if feasible, although this is not a substitute for proper code-level fixes. Additionally, implementing strict input validation and ensuring that all backend operations verify user permissions against the requested resource ID are essential steps in hardening the application against similar vulnerabilities. Regular security audits and penetration testing focusing on broken access control patterns will help identify any residual weaknesses before they can be exploited by malicious actors seeking to compromise e-commerce infrastructure.