[IT-SecNots] [Security-news] Commerce Escrow - Moderately critical - Access bypass - SA-CONTRIB-2026-302

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-302

Project: Commerce Escrow [1]
Project machine name: commerce_escrow
Date: 2026-November-04
Security risk: *Moderately critical* 13 ∕ 25
AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All [2]
Vulnerability: Access bypass

Affected versions: <1.1.0
CVE IDs: CVE-2026-122071
Description: 
This module enables you to accept payments through Escrow.com with Drupal
Commerce.

The module doesn't sufficiently verify incoming Escrow.com webhook
notifications. An attacker can forge payment and order status updates,
marking unpaid orders as paid or completed, or cancelling orders that are in
progress.

Solution: 
Install the latest version:

 * Upgrade to Commerce Escrow 1.1.0 [3]. (1.0.x versions are no longer
   supported.)

After updating, register the new webhook URL with Escrow.com. It is shown on
the configuration form of each Escrow payment gateway.

Reported By: 
 * Marcus Johansson (marcus_johansson) [4]

Fixed By: 
 * Valentino Međimorec (valic) [5]

Coordinated By: 
 * Swan Kalata (akalata) [6] of the Drupal Security Team
 * Bram Driesen (bramdriesen) [7] of the Drupal Security Team
 * Juraj Nemec (poker10) [8] of the Drupal Security Team
 * Jess  (xjm) [9] of the Drupal Security Team

------------------------------------------------------------------------------
Contribution record [10]

[1] https://www.drupal.org/project/commerce_escrow
[2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined
[3] https://www.drupal.org/project/commerce_escrow/releases/1.1.0
[4] https://www.drupal.org/u/marcus_johansson
[5] https://www.drupal.org/u/valic
[6] https://www.drupal.org/u/akalata
[7] https://www.drupal.org/u/bramdriesen
[8] https://www.drupal.org/u/poker10
[9] https://www.drupal.org/u/xjm
[10]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3629732

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at