CVE-2026-73475
CVE-2026-73475 · Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3.
CVSS 9.1 · Critical · EPSS 0.4% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
commerce paypal
- Versions
- ≥ 0.0.0, < 1.12.0: Affected (semver)
- ≥ 2.0.0, < 2.1.3: Affected (semver)
Update to 1.12.0; Update to 2.1.3
drupal/commerce_paypal Packagist:https://packages.drupal.org/8
- Affected ranges
- ECOSYSTEM: < 1.12.0
- ECOSYSTEM: ≥ 2.0.0, < 2.1.3
Update to 1.12.0; Update to 2.1.3