[IT-SecNots] [Security-news] Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-179

Project: Commerce Decoupled Checkout [1]
Project machine name: commerce_decoupled_checkout
Date: 2026-September-23
Security risk: *Moderately critical* 13 ∕ 25
AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All [2]
Vulnerability: Access bypass

Affected versions: >=1.0.0 <1.8.0
CVE IDs: CVE-2026-96378
Description: 
This module enables REST endpoints for a decoupled Commerce experience which
allow for remote order creation.

The module doesn't sufficiently sanitize order data passed into the order
creation endpoint, which allows for potentially unsafe order properties to be
set on an order.

Solution: 
Install the latest version of the module:

 * Update to Commerce Decoupled Checkout 8.x-1.8 [3].

The standard order fields type, email, store, and order_items remain accepted
by default.

Sites submitting additional custom order fields must explicitly enable them
at /admin/commerce/config/decoupled-checkout. Requests containing fields
outside this allowlist will be rejected.

Run database updates and configure the required customer-writable fields
before resuming checkout.

Reported By: 
 * Marcus Johansson (marcus_johansson) [4]

Fixed By: 
 * Leo Pitt (leo pitt) [5]
 * Marcus Johansson (marcus_johansson) [6]

Coordinated By: 
 * Swan Kalata (akalata) [7] of the Drupal Security Team
 * Bram Driesen (bramdriesen) [8] of the Drupal Security Team
 * Greg Knaddison (greggles) [9] of the Drupal Security Team
 * Jess  (xjm) [10] of the Drupal Security Team

------------------------------------------------------------------------------
Contribution record [11]

[1] https://www.drupal.org/project/commerce_decoupled_checkout
[2] https://www.drupal.org/security-team/risk-levels
[3]  
https://www.drupal.org/project/commerce_decoupled_checkout/releases/8.x-1.8
[4] https://www.drupal.org/u/marcus_johansson
[5] https://www.drupal.org/u/leo-pitt
[6] https://www.drupal.org/u/marcus_johansson
[7] https://www.drupal.org/u/akalata
[8] https://www.drupal.org/u/bramdriesen
[9] https://www.drupal.org/u/greggles
[10] https://www.drupal.org/u/xjm
[11]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3622259

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at