🔐 CVE Alert

CVE-2026-96378

UNKNOWN 0.0

Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179

CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce Decoupled Checkout allows Object Injection. This issue affects Commerce Decoupled Checkout versions: from 1.0.0 to 1.8.0.

CWE CWE-915
Vendor drupal
Product commerce decoupled checkout
Ecosystems
Industries
WebMedia
Published Oct 22, 2026
Stay Ahead of the Next One

Get instant alerts for drupal commerce decoupled checkout

Be the first to know when new unknown vulnerabilities affecting drupal commerce decoupled checkout are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Drupal / Commerce Decoupled Checkout
1.0.0 < 1.8.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗
drupal.org: https://www.drupal.org/sa-contrib-2026-179

Credits

Marcus Johansson (marcus_johansson) Leo Pitt (leo pitt) Marcus Johansson (marcus_johansson) Swan Kalata (akalata) Bram Driesen (bramdriesen) Greg Knaddison (greggles) Jess (xjm)