DRUPAL-CONTRIB-2026-301

See a problem?
Import Source
https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/commerce_product_alternative/DRUPAL-CONTRIB-2026-301.json
JSON Data
https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2026-301
Aliases
  • CVE-2026-122070
Published
2026-11-04T17:33:18Z
Modified
2026-11-04T20:30:04Z
Summary
[none]
Details

This module lets customers replace an item in their cart with one of the alternative product variations listed for it.

The module does not check that a cart belongs to the current visitor when the visitor is not logged in. An anonymous visitor can view items in other anonymous visitors' carts, including product names and prices, and replace those items with one of their listed alternatives.

The vulnerability is mitigated by the fact that only carts of anonymous visitors are affected; carts of authenticated customers are not.

References
Credits

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/commerce_product_alternative

Package

Name
drupal/commerce_product_alternative
Purl
pkg:composer/drupal/commerce_product_alternative?repository_url=https:%2F%2Fpackages.drupal.org%2F8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.0.1
Database specific
Show details 
{
    "constraint": "<1.0.1"
}

Database specific

affected_versions 
"<1.0.1"
source 
"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/commerce_product_alternative/DRUPAL-CONTRIB-2026-301.json"