| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/commerce | ≥ 3.0.0, < 3.2.0< 2.41.0 | 3.2.02.41.0 |
This module enables you to sell goods and services to customers through a shopping cart and checkout form.
When Drupal Commerce is used with the JSON:API module, it is possible for unpublished product variations to be accessible to users without permission.
This vulnerability is mitigated by only affecting sites with published products and unpublished product variations.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free