CVE-2026-73475 - Vulnerability Details - OpenCVE

Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Drupal	Commerce Paypal

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2026-095

History

Thu, 03 Sep 2026 08:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 02 Sep 2026 19:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}`

Wed, 02 Sep 2026 17:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Drupal Drupal commerce Paypal
Vendors & Products		Drupal Drupal commerce Paypal

Wed, 02 Sep 2026 13:00:00 +0000

Type	Values Removed	Values Added
Description		Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3.
Title		Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095
Weaknesses		CWE-863
References		https://www.drupal.org/sa-contrib-2026-095

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2026-09-02T12:32:41.731Z

Updated: 2026-09-02T18:33:12.159Z

Reserved: 2026-08-12T17:21:18.776Z

Link: CVE-2026-73475

Vulnrichment

Updated: 2026-09-02T18:32:54.786Z

NVD

Status : Awaiting Analysis

Published: 2026-09-02T13:18:08.300

Modified: 2026-09-02T19:18:02.140

Link: CVE-2026-73475

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73475", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2026-08-12T17:21:18.776Z", "datePublished": "2026-09-02T12:32:41.731Z", "dateUpdated": "2026-09-02T18:33:12.159Z"}, "containers": {"cna": {"title": "Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095", "datePublic": "2026-08-12T17:53:15.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-095"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-87", "descriptions": [{"lang": "en", "value": "CAPEC-87 Forceful Browsing"}]}], "affected": [{"collectionURL": "https://www.drupal.org/project/commerce_paypal", "product": "Commerce PayPal", "vendor": "Drupal", "repo": "https://git.drupalcode.org/project/commerce_paypal", "versions": [{"lessThan": "1.12.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}, {"lessThan": "2.1.3", "status": "affected", "version": "2.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3."}], "credits": [{"lang": "en", "type": "finder", "value": "Kimberley Massey (kimberleycgm)"}, {"lang": "en", "type": "remediation developer", "value": "Jonathan Sacksick (jsacksick)"}, {"lang": "en", "type": "remediation developer", "value": "Kimberley Massey (kimberleycgm)"}, {"lang": "en", "type": "remediation developer", "value": "Ryan Szrama (rszrama)"}, {"lang": "en", "type": "remediation developer", "value": "Tom Ashe (tomtech)"}, {"lang": "en", "type": "coordinator", "value": "Swan Kalata (akalata)"}, {"lang": "en", "type": "coordinator", "value": "Benji Fisher (benjifisher)"}, {"lang": "en", "type": "coordinator", "value": "Neil Drumm (drumm)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-09-02T12:32:41.731Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-09-02T18:33:08.348004Z", "id": "CVE-2026-73475", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-02T18:33:12.159Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-73475", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-02T18:33:08.348004Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-02T18:32:54.786Z"}}], "cna": {"title": "Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095", "credits": [{"lang": "en", "type": "finder", "value": "Kimberley Massey (kimberleycgm)"}, {"lang": "en", "type": "remediation developer", "value": "Jonathan Sacksick (jsacksick)"}, {"lang": "en", "type": "remediation developer", "value": "Kimberley Massey (kimberleycgm)"}, {"lang": "en", "type": "remediation developer", "value": "Ryan Szrama (rszrama)"}, {"lang": "en", "type": "remediation developer", "value": "Tom Ashe (tomtech)"}, {"lang": "en", "type": "coordinator", "value": "Swan Kalata (akalata)"}, {"lang": "en", "type": "coordinator", "value": "Benji Fisher (benjifisher)"}, {"lang": "en", "type": "coordinator", "value": "Neil Drumm (drumm)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}], "impacts": [{"capecId": "CAPEC-87", "descriptions": [{"lang": "en", "value": "CAPEC-87 Forceful Browsing"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/commerce_paypal", "vendor": "Drupal", "product": "Commerce PayPal", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "1.12.0", "versionType": "semver"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.1.3", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/commerce_paypal"}], "datePublic": "2026-08-12T17:53:15.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-095"}], "descriptions": [{"lang": "en", "value": "Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-09-02T12:32:41.731Z"}}}, "cveMetadata": {"cveId": "CVE-2026-73475", "state": "PUBLISHED", "dateUpdated": "2026-09-02T18:33:12.159Z", "dateReserved": "2026-08-12T17:21:18.776Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2026-09-02T12:32:41.731Z", "assignerShortName": "drupal"}, "dataVersion": "5.2"}