Drupal Commerce CVE-2026-118539: Exploited Access Bypass

Anonymous visitors can reach parts of a Drupal Commerce store they should never touch, and Drupal says attackers are already doing it. The fix for Drupal Commerce CVE-2026-118539 came out on 28 Octobe