CVE-2026-73475
Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095
CVSS Score
9.1
EPSS Score
0.0%
EPSS Percentile
0th
Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3.
| CWE | CWE-863 |
| Vendor | drupal |
| Product | commerce paypal |
| Ecosystems | |
| Industries | WebMedia |
| Published | Sep 2, 2026 |
| Last Updated | Sep 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for drupal commerce paypal
Be the first to know when new critical vulnerabilities affecting drupal commerce paypal are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Drupal / Commerce PayPal
0.0.0 < 1.12.0 2.0.0 < 2.1.3
Credits
Kimberley Massey (kimberleycgm) Jonathan Sacksick (jsacksick) Kimberley Massey (kimberleycgm) Ryan Szrama (rszrama) Tom Ashe (tomtech) Swan Kalata (akalata) Benji Fisher (benjifisher) Neil Drumm (drumm) Greg Knaddison (greggles) Juraj Nemec (poker10)