it-securitynotifies AT lists.piratenpartei.de
Betreff: Sicherheitsankündigungen
Listenarchiv
[IT-SecNots] [Security-news] AlternativeCommerce PayPal Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-300
Chronologisch Thread
- From: security-news AT drupal.org
- To: security-news AT drupal.org
- Subject: [IT-SecNots] [Security-news] AlternativeCommerce PayPal Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-300
- Date: Wed, 4 Nov 2026 17:33:06 +0000
- Arc-authentication-results: i=2; smtp3.osuosl.org; dmarc=pass header.from=drupal.org; dkim=pass header.d=drupal.org header.i= AT drupal.org header.a=rsa-sha256 header.s=h2cwj55irf2bug4gly7tdskg3xbjhlg6 header.b=In1eijU8; dkim=pass header.d=amazonses.com header.i= AT amazonses.com header.a=rsa-sha256 header.s=hsbnp7p3ensaochzwyq5wwmceodymuwv header.b=X7yGw0Kt; arc=fail smtp.remote-ip=140.211.10.49
- Arc-authentication-results: i=1; smtp3.osuosl.org; dmarc=pass header.from=drupal.org; dkim=pass header.d=drupal.org header.i= AT drupal.org header.a=rsa-sha256 header.s=h2cwj55irf2bug4gly7tdskg3xbjhlg6 header.b=In1eijU8; dkim=pass header.d=amazonses.com header.i= AT amazonses.com header.a=rsa-sha256 header.s=hsbnp7p3ensaochzwyq5wwmceodymuwv header.b=X7yGw0Kt; arc=none smtp.remote-ip=54.240.27.34
- Arc-filter: OpenARC Filter v1.3.2 smtp3.osuosl.org EB2E261BC8
- Arc-filter: OpenARC Filter v1.3.2 smtp3.osuosl.org D7A976062C
- Arc-message-signature: i=2; d=osuosl.org; s=arc; a=rsa-sha256; c=relaxed/relaxed; t=1793815792; h=X-Comment:DKIM-Signature:Received:X-Spam-Flag:X-Spam-Score: X-Spam-Level:X-Spam-Status:ARC-Filter:Received-SPF:DKIM-Signature: DKIM-Signature:Date:To:MIME-Version:Feedback-ID:X-Mailman-Rule-Hits: X-Mailman-Rule-Misses:Message-ID-Hash:X-Mailman-Approved-At: Message-ID:From:X-Mailman-Version:Precedence:Reply-To:Subject:List-Id: Archived-At:List-Archive:List-Help:List-Owner:List-Post: List-Subscribe:List-Unsubscribe:Content-Type: Content-Transfer-Encoding; bh=RChDhgnOdpxc13AiRSZFZquWcDHGp8dE6Ws5LqHoXfY=; b=EnM4kM7Ei1iScu+RCsflAsEtrHp7+3TBn1aGL5cWtQE1oSIPLNVaoLhBDPcWC0P8DaOb eR2hg9CHDztc6GWJgGvigiFWtIWs3eKhZCuSJ4KX5ERZv4G2m6wBmCKPUq92JNL+Z8MyJ ehEHqKv0WpSmP3NFMlBNrk1PyQboqp0+Lxl84fuMTF3zsKtrGZoS9FCelR2VPgnB48t2c w26y8tc1VhpKRzmXQd8o/cVFNNrEpahHL3a9joBkUd5tHgBWMMc4LGEOqV/BU8LyLzJpH drlUrn3ryF7S9Vgth9WN2lR65RxzKaHzOyPThdWP1ecOuOYGTBW4igMHDc7j5E7WW1g==
- Arc-message-signature: i=1; d=osuosl.org; s=arc; a=rsa-sha256; c=relaxed/relaxed; t=1793813587; h=Received-SPF:DKIM-Signature:DKIM-Signature:Date:Message-ID:To: Subject:MIME-Version:Content-Type:Content-Transfer-Encoding:X-Mailer: Sender:From:Feedback-ID:X-SES-Outgoing; bh=Hct2G2t/sQlsh3m0Jq083+F9YHX0LJ/uAXRdIHR8rrg=; b=EN27+fIqG7ulUIGyl14bfzPCc2cm2tNjjOgpa+rfIcUvifW1K6bjGZiLgjdgvrtJExJ+ P+TICnkihRwKJOe7+zfLlXlq9Bwv2K8U8g+T4PFjEsVNonb8hqe/WurEzUMFu1KFjduCk mditxDXwK2TqlGyiRpPFC2vOFKzhCEr4Q6XCoqmoC9GM9uenzVJJkkYi/o3PgmLlHgWvj k/7DuJxZiqrZDY1b4OqGRPwsUHkbpzEQ8e2wuO908IbqzS/sgrphxdVfgw0tA+2mdhKsr vHl13f3U3vAQ/ifTmG4GjhrUgCU85X8krmFGUNi1WzoCaNRTMOaUs4Aia7RKR4Ld/ZQ==
- Arc-seal: i=2; d=osuosl.org; s=arc; a=rsa-sha256; cv=fail; t=1793815792; b=HVWVpx9Q1hfbsW+fyRgFqutidVXa/wM97oWsdjen6lyVBnSGXk1ilLyimm0vxZipyEt9 tC23QFDZZopv5W0iH8MA5vPl5aEF8WibmQeLyeV8HvD/kZ8cgPzhtF2xGf/ZvED+re9yn PkMep+taHwtK47n6m2/nXvO2EAA/PMlCzrc62DhiXttOaFibiDD7OR+Owu3EryX1f2ffx fJo3R0JEQgH9Ej8fkiYeNGCoWU4av3qdrmzw3chSeELcxZb3cuvGACKkVaEsPUm7S/zNf RYdGB5w6jJX5CDxuhV7JL3Z9LjiE3Jm5RTV7m+PanVdbtpnTFkRqjuRTge0p4bgqoUg==
- Arc-seal: i=1; d=osuosl.org; s=arc; a=rsa-sha256; cv=none; t=1793813587; b=Mf/lhr70s1wu0fpG4DqBCX5gVL8u9RebDKDlMwmfkiujZJrtmIyYYl3dxyv8UzO01xWm g/uleqXPTtA1R0NRL38uj7WyABMZ9MqaaJ+yHgXq+ALEx3yLHyY9BNnrBkUC/9xqu4Eve b8aPJKlAoGsGl38g1Se5tg5We8VE78YaJnUoYp9v7YrzRUSc0+IDErAMOmvaZi6OnFqQS I0euk6qOWW6sYnnT5ZOk80iZqqve72chwf8E2ZPiF3K87Ertx7ddXdvR3UQcBnuE9lTpt Xs4nw2k2vjHLftWdTZgHk+q8UjWQOhf5AlS10kzWJ0S3pzLLRKvovW5W3sR5vJIWUGw==
- Archived-at: <https://lists.drupal.org/mailman3/hyperkitty/list/security-news AT drupal.org/message/RTP3B3Y5MPHYAHWTGPFPNMC6TBWAJNWK/>
- Authentication-results: lists.piratenpartei.de; dkim=pass header.d=drupal.org header.s=default header.b=i84lihIB; dkim=fail ("body hash did not verify") header.d=drupal.org header.s=h2cwj55irf2bug4gly7tdskg3xbjhlg6 header.b=In1eijU8; dkim=fail ("body hash did not verify") header.d=amazonses.com header.s=hsbnp7p3ensaochzwyq5wwmceodymuwv header.b=X7yGw0Kt; spf=pass (lists.piratenpartei.de: domain of security-news-bounces AT drupal.org designates 2605:bc80:3010::136 as permitted sender) smtp.mailfrom=security-news-bounces AT drupal.org; arc=reject ("cv is fail on i=2"); dmarc=pass (policy=none) header.from=drupal.org
- Feedback-id: ::1.us-west-2.eaokZ1GT8utLqfMHQoyOsEFVrSIzzS6R+14LP6WIIUY=:AmazonSES
- List-archive: <https://lists.drupal.org/mailman3/hyperkitty/list/security-news AT drupal.org/>
- List-id: <security-news.drupal.org>
View online: https://www.drupal.org/sa-contrib-2026-300
Project: AlternativeCommerce PayPal Checkout [1]
Project machine name: basket_paypal
Date: 2026-November-04
Security risk: *Moderately critical* 13 ∕ 25
AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All [2]
Vulnerability: Access bypass
Affected versions: <1.1.1 || >=2.0.0 <2.0.0-beta2
CVE IDs: CVE-2026-122069
Description:
The AlternativeCommerce PayPal Checkout module provides an
AlternativeCommerce method to embed payment services from PayPal.
The module does not sufficiently validate incoming PayPal webhook requests.
An unauthenticated attacker can submit a crafted request that references a
payment record, causing the associated order to be marked as paid without
completing a payment.
Solution:
Install the latest version:
* Upgrade to AlternativeCommerce PayPal 1.1.1 [3].
Reported By:
* Marcus Johansson (marcus_johansson) [4]
Fixed By:
* Helena Zajika (helena zajika) [5]
Coordinated By:
* Swan Kalata (akalata) [6] of the Drupal Security Team
* Juraj Nemec (poker10) [7] of the Drupal Security Team
* Jess (xjm) [8] of the Drupal Security Team
------------------------------------------------------------------------------
Contribution record [9]
[1] https://www.drupal.org/project/basket_paypal
[2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined
[3] https://www.drupal.org/project/basket_paypal/releases/1.1.1
[4] https://www.drupal.org/u/marcus_johansson
[5] https://www.drupal.org/u/helena-zajika
[6] https://www.drupal.org/u/akalata
[7] https://www.drupal.org/u/poker10
[8] https://www.drupal.org/u/xjm
[9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3624919
_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at
- [IT-SecNots] [Security-news] AlternativeCommerce PayPal Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-300, security-news, 04.11.2026
Archiv bereitgestellt durch MHonArc 2.6.19+.