DRUPAL-CONTRIB-2026-302

Import Source

https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/commerce_escrow/DRUPAL-CONTRIB-2026-302.json

JSON Data

https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2026-302

Aliases

CVE-2026-122071

Published

2026-11-04T17:33:57Z

Modified

2026-11-04T20:30:02Z

Summary

[none]

Details

This module enables you to accept payments through Escrow.com with Drupal Commerce.

The module doesn't sufficiently verify incoming Escrow.com webhook notifications. An attacker can forge payment and order status updates, marking unpaid orders as paid or completed, or cancelling orders that are in progress.

References

https://www.drupal.org/sa-contrib-2026-302

Credits

- Marcus Johansson (marcus_johansson)
- - https://www.drupal.org/u/marcus_johansson

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/commerce_escrow

Package

Name: drupal/commerce_escrow
Purl: pkg:composer/drupal/commerce_escrow?repository_url=https:%2F%2Fpackages.drupal.org%2F8

Affected ranges

Type

ECOSYSTEM

Events

Introduced

Fixed

1.1.0

Database specific

Show details

{
    "constraint": "<1.1.0"
}

Database specific

affected_versions

"<1.1.0"

source

"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/commerce_escrow/DRUPAL-CONTRIB-2026-302.json"