Drupal
Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254
SA-CONTRIB-2026-254 Oct 28, 2026 Source: Vendor
Imported by the Drupal advisory catcher from https://www.drupal.org/sa-contrib-2026-254. 3 reporter(s), 6 fixer(s). Draft. Review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.drupal.org/sa-contrib-2026-254
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
9 lines
Showing 1–9 of 9
CVE-2026-118539
BR2026-0000-041061
unclaimed
Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254
Credited as Dan Puccetti (dpuccetti)
CVE-2026-118539
BR2026-0000-041062
unclaimed
Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254
Credited as Marcus Johansson (marcus_johansson)
CVE-2026-118539
BR2026-0000-041063
unclaimed
Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254
Credited as Robert Snyder (rsnyd)
CVE-2026-118539
BR2026-0000-041064
unclaimed
Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254
Credited as Jonathan Sacksick (jsacksick)
CVE-2026-118539
BR2026-0000-041065
unclaimed
Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254
Credited as Lee Rowlands (larowlan) of the Drupal Security Team
CVE-2026-118539
BR2026-0000-041066
unclaimed
Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254
Credited as Mohit Aghera (mohit_aghera) provisional member of the Drupal Security Team
CVE-2026-118539
BR2026-0000-041067
unclaimed
Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254
Credited as Ryan Szrama (rszrama)
CVE-2026-118539
BR2026-0000-041068
unclaimed
Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254
Credited as Tom Ashe (tomtech)
CVE-2026-118539
BR2026-0000-041069
unclaimed
Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254
Credited as Jakub Piasecki (zaporylie)