it-securitynotifies AT lists.piratenpartei.de

Betreff: Sicherheitsankündigungen

Listenarchiv

[IT-SecNots] [Security-news] Commerce Product Alternative - Critical - Access bypass - SA-CONTRIB-2026-301

From: security-news AT drupal.org
To: security-news AT drupal.org
Subject: [IT-SecNots] [Security-news] Commerce Product Alternative - Critical - Access bypass - SA-CONTRIB-2026-301
Date: Wed, 4 Nov 2026 17:33:19 +0000
Arc-authentication-results: i=2; smtp4.osuosl.org; arc=fail smtp.remote-ip=140.211.10.49
Arc-authentication-results: i=1; smtp1.osuosl.org; dmarc=pass header.from=drupal.org; dkim=pass header.d=drupal.org header.i= AT drupal.org header.a=rsa-sha256 header.s=h2cwj55irf2bug4gly7tdskg3xbjhlg6 header.b=mDGUSPn2; dkim=pass header.d=amazonses.com header.i= AT amazonses.com header.a=rsa-sha256 header.s=hsbnp7p3ensaochzwyq5wwmceodymuwv header.b=rUjDLmqV; arc=none smtp.remote-ip=54.240.27.115
Arc-filter: OpenARC Filter v1.3.2 smtp4.osuosl.org 769B6411A0
Arc-filter: OpenARC Filter v1.3.2 smtp1.osuosl.org D55B580BF7
Arc-message-signature: i=2; d=osuosl.org; s=arc; a=rsa-sha256; c=relaxed/relaxed; t=1793815861; h=X-Comment:DKIM-Signature:Received:X-Spam-Flag:X-Spam-Score: X-Spam-Level:X-Spam-Status:ARC-Filter:Received-SPF:DKIM-Signature: DKIM-Signature:Date:To:MIME-Version:Feedback-ID:X-Mailman-Rule-Hits: X-Mailman-Rule-Misses:Message-ID-Hash:X-Mailman-Approved-At: Message-ID:From:X-Mailman-Version:Precedence:Reply-To:Subject:List-Id: Archived-At:List-Archive:List-Help:List-Owner:List-Post: List-Subscribe:List-Unsubscribe:Content-Type: Content-Transfer-Encoding; bh=d/JGKj0cBnwy50m6GDcqnBsiU50jZinp8u1JsiFqDB4=; b=tLrVrdKDMPcI08F4Ni7RJUzKoFZAArrosDu4ppXGuAKKp2EMarCdiZnzy9fgMGoU6Pmh YuYyuW+wd/BThuZY1xIes49J8DaDOkaCDuOF36d5lqVB1VOMttO0cLGjXIapxsVGLGSbD eNuCOhrqvFYLfAVYR5bjc/EpM592AxU8e/P+uzK4DJG5AC0TezJ9HeOYPukKpRH/zf3Nf aAfcDpOep/L9HQR0aPPNVddgL1O0Wz9i12Nef/1IslwD8JnVyHo1UBdqZpq0oX7ul7o0f AYSjX0rchsxzi6uPM9tY+Z0T5taIKfczaaiCuFVrcWftglRg+LXS4n68DQp+m0aWoGg==
Arc-message-signature: i=1; d=osuosl.org; s=arc; a=rsa-sha256; c=relaxed/relaxed; t=1793813601; h=Received-SPF:DKIM-Signature:DKIM-Signature:Date:Message-ID:To: Subject:MIME-Version:Content-Type:Content-Transfer-Encoding:X-Mailer: Sender:From:Feedback-ID:X-SES-Outgoing; bh=jHYnL5lpIpX7xFH3P4wcXhA3nDIeSCLjETVPn0IjHtw=; b=Sp/+A0H7EE8+88lbDYrS/KT7pumVVT4zkEEkoA4B7SPcuQ7PuSa2M8AWAZe7anYLtaQf eevuewtENa1KXJVG/wl7rPglUaD5nLpahFQ3Gf9XJhrfz+G2OreT3Owoz4e2ykwvV9ry5 vd13f3IRNxq6rsjQnu21llV8f9KJz7GHe4CcpkQ97AzgGCFB1zhgvoqp1R1PcwFxf8hhc hsjrQabhSPAjZ3Wp+FDUXCgEd3k5ZLBssgdsdFG8g1DsrwBAw4sjvH6DgdBvb9Q/UNYpp 1b5WTuDMFe8YsmjUsTCaitDpycz0BI4mq1OHPnVsIzxIK8mZtodRixoehQDaVgu+ZYA==
Arc-seal: i=2; d=osuosl.org; s=arc; a=rsa-sha256; cv=fail; t=1793815861; b=NDCJsQbuFDN2f3fFvF41CwZU5iyKLubd5a2vRq7KR7woCxktEYU8nHvC7gXAB4UZXAw6 r1f68BVRKDvkmbK9SLaXpO74BsfdVuCJZoJm8b20ZBlx7Xlr+ih8JoKI8gjWe59shkhnB O9890CE7SFTkIEg1jFxxiU2K+7u+vwY/g98OqoCC+UhgNdyfGTxvz6SJU95Pg8RezSJxH 2t69weao3JQSt/1l4gpVDEuesd4lYiE/zKxcA/qqMIppxre9FmV06mgb7Y5v5zgUSWfJq OXFetj0OCVIM1cCEiNoTYpyNaJJ2nGkstVCejiG2MWDEY4vNGwVEDmQvvntg64e/yFA==
Arc-seal: i=1; d=osuosl.org; s=arc; a=rsa-sha256; cv=none; t=1793813601; b=lfZoAro+T/jlebNovpz8y4+zXFOHSTb6SeN5PThIxKY9ymM3HEX1JrN/dXYKm9Q+L0Ff 151Ee//QXXsdI9PnlBRDQvN9zvflbFw57f1NFaZ7KGVimWBA7nfqdCGJn8NgxjT2rR69j oQc7FnT4jYdR0QPjoQSFWLLifiYHPP9p9SD4GvtbMnh9n1TJiDtOPbB/5wXdG2At1A79v ZCsBTw+gJ65CD5A5WUeuVTuFNQJVfpwzIZdBFPWF5MWcAAFnHo5Q+upvUmP8kvoD7dQ70 /Lb6ikEHnK3hLKFSaEtI9va2fgCMp/jsH0IMXKJ9RMcah/Ggo1Qu5xjFw0OmH7cuJlg==
Archived-at: <https://lists.drupal.org/mailman3/hyperkitty/list/security-news AT drupal.org/message/HEOER3DWQKXW4NEP2LXTRAJSAPJJ4GIC/>
Authentication-results: lists.piratenpartei.de; dkim=pass header.d=drupal.org header.s=default header.b=cMuZUdNO; dkim=fail ("body hash did not verify") header.d=drupal.org header.s=h2cwj55irf2bug4gly7tdskg3xbjhlg6 header.b=mDGUSPn2; dkim=fail ("body hash did not verify") header.d=amazonses.com header.s=hsbnp7p3ensaochzwyq5wwmceodymuwv header.b=rUjDLmqV; spf=pass (lists.piratenpartei.de: domain of security-news-bounces AT drupal.org designates 140.211.166.137 as permitted sender) smtp.mailfrom=security-news-bounces AT drupal.org; arc=reject ("cv is fail on i=2"); dmarc=pass (policy=none) header.from=drupal.org
Feedback-id: ::1.us-west-2.eaokZ1GT8utLqfMHQoyOsEFVrSIzzS6R+14LP6WIIUY=:AmazonSES
List-archive: <https://lists.drupal.org/mailman3/hyperkitty/list/security-news AT drupal.org/>
List-id: <security-news.drupal.org>

View online: https://www.drupal.org/sa-contrib-2026-301

Project: Commerce Product Alternative [1]
Project machine name: commerce_product_alternative
Date: 2026-November-04
Security risk: *Critical* 16 ∕ 25
AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2]
Vulnerability: Access bypass

Affected versions: <1.0.1
CVE IDs: CVE-2026-122070
Description:
This module lets customers replace an item in their cart with one of the
alternative product variations listed for it.

The module does not check that a cart belongs to the current visitor when the
visitor is not logged in. An anonymous visitor can view items in other
anonymous visitors' carts, including product names and prices, and replace
those items with one of their listed alternatives.

The vulnerability is mitigated by the fact that only carts of anonymous
visitors are affected; carts of authenticated customers are not.

Solution:
Install the latest version:

* Upgrade to Commerce Product Alternative 1.0.1 [3].

Reported By:
* Tim de Jong (tim_dj) [4]

Fixed By:
* Jakub Piasecki (zaporylie) [5]

Coordinated By:
* Swan Kalata (akalata) [6] of the Drupal Security Team
* Juraj Nemec (poker10) [7] of the Drupal Security Team
* Jess (xjm) [8] of the Drupal Security Team

------------------------------------------------------------------------------
Contribution record [9]

[1] https://www.drupal.org/project/commerce_product_alternative
[2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined
[3] https://www.drupal.org/project/commerce_product_alternative/releases/1.0.1
[4] https://www.drupal.org/u/tim_dj
[5] https://www.drupal.org/u/zaporylie
[6] https://www.drupal.org/u/akalata
[7] https://www.drupal.org/u/poker10
[8] https://www.drupal.org/u/xjm
[9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3634485

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at

[IT-SecNots] [Security-news] Commerce Product Alternative - Critical - Access bypass - SA-CONTRIB-2026-301, security-news, 04.11.2026

Archiv bereitgestellt durch MHonArc 2.6.19+.