CVE-2026-118557

3th percentile - higher than 3% of all known CVEs

The Drupal Commerce Shipping module has an incorrect authorization vulnerability that allows forceful browsing of unauthorized resources. This issue affects versions from 0.0.0 to 2.16.0 and from 3.0.0 to 3.0.6.

An attacker could access functions or data they are not entitled to, potentially leading to information disclosure or manipulation of the shipping process. This may compromise the confidentiality and integrity of order data.

Update the Commerce Shipping module to a version later than 2.16.0 or 3.0.6. Review role permissions and ensure resource access is properly restricted.