> ## Content Index
> Fetch the complete content index at: https://stackurity.ai/blog/llms.txt
> Use this file to discover other available public pages before exploring further.

# Drupal warns that a critical Commerce Core flaw is exploited
- URL: https://stackurity.ai/blog/drupal-commerce-core-critical-flaw-exploited/
- Published: 2026-10-31T06:05:04.000Z
- Updated: 2026-10-31T06:05:04.000Z
- Description: Drupal is urging site owners to fix a serious authorisation bypass in Commerce Core that is used in live attacks. Here is how to check your sites.
- Author: Stackurity Research Team
- Tags: Linux Servers, News

**TL;DR:** Drupal is urging site owners to fix a serious authorisation bypass in Commerce Core, and it is already being used against live sites.

## What happened

BleepingComputer [reported](https://www.bleepingcomputer.com/news/security/drupal-warns-of-critical-commerce-core-flaw-exploited-in-attacks/) on October 30, 2026 that Drupal issued a warning about a critical vulnerability in the Commerce Core module. The flaw lets a visitor get around access checks, and the Drupal project says it is being used in real attacks. The report is short and does not give a fixed version, so follow the Drupal security advisory for the exact release to install.

## Am I affected?

You are exposed if a site runs Drupal with the Commerce Core module enabled, which is typical for online stores. To check one site by hand, run `composer show drupal/commerce` in the project directory, or `drush pm:list --status=enabled | grep -i commerce`, then compare the version with the one named in Drupal's advisory. Prioritise any store that is reachable from the internet, and review access logs for unusual requests to store administration paths.

## How to check with Stackurity

Stackurity reads the Composer lockfiles of repositories you add, so a Commerce Core dependency shows up as a finding once an advisory covers it, and it matches the inventory against new advisories every hour. It does not scan a copy of a module that was pasted into a site outside Composer. Stackurity does not cover that case, so use the hand check above for it.

Stackurity keeps a live inventory of installed packages through a read-only agent on Linux servers and matches it against new advisories every hour, using each distribution's own version rules so that backports are not reported as false alarms. After an upgrade, check again records whether the issue is really gone. Read how [verification](https://stackurity.ai/docs/verification) works. The core is open source, and Stackurity Cloud offers a 14-day free trial without a card: [start a free trial](https://app.stackurity.dev/signup?utm%5Fsource=blog&utm%5Fmedium=referral&utm%5Fcampaign=linux-servers&utm%5Fcontent=drupal-commerce-core-critical-flaw-exploited).