CVE-2026-73475: Drupal Commerce PayPal Auth Bypass Flaw

CVE-2026-73475 Overview

CVE-2026-73475 is an Incorrect Authorization vulnerability [CWE-863] in the Drupal Commerce PayPal contributed module. The flaw permits Forceful Browsing, allowing unauthenticated attackers to access protected resources by directly requesting URLs without passing through authorization checks. The issue affects Commerce PayPal versions 0.0.0 through 1.12.0 and 2.0.0 through 2.1.3. The vulnerability is network-exploitable, requires no privileges, and needs no user interaction.

Critical Impact
Remote attackers can bypass authorization on Drupal sites running vulnerable Commerce PayPal versions, exposing confidential transaction data and enabling unauthorized modification of payment-related resources.

Affected Products

Drupal Commerce PayPal 0.0.0 through 1.12.0
Drupal Commerce PayPal 2.0.0 through 2.1.3
Drupal sites using the Commerce PayPal contributed module

Discovery Timeline

2026-09-02 - CVE-2026-73475 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-73475

Vulnerability Analysis

CVE-2026-73475 stems from missing or incorrect authorization checks in the Commerce PayPal module for Drupal. The module exposes routes or controllers that fail to verify whether the requesting user is authorized to access the underlying resource. Attackers exploit this by directly navigating to predictable endpoint paths, a technique known as Forceful Browsing.

The vulnerability affects the confidentiality and integrity of payment-related data managed by the module. Because the affected module handles PayPal transactions for Drupal Commerce, exposed resources may include order details, payment states, and callback data used during checkout.

Root Cause

The root cause is an authorization logic defect classified as [CWE-863] Incorrect Authorization. The module enforces access control incorrectly on one or more routes, permitting requests that should be rejected. Correct enforcement requires validating both authentication state and the permission scope tied to the requested resource.

Attack Vector

An attacker sends crafted HTTP requests directly to affected Commerce PayPal endpoints on a target Drupal site. No credentials or user interaction are required. The attacker enumerates or guesses resource identifiers to retrieve or alter data that should be protected. See the Drupal Security Advisory for authoritative technical details.

Detection Methods for CVE-2026-73475

Indicators of Compromise

Anomalous HTTP requests to Commerce PayPal module routes from unauthenticated sessions.
Sequential or enumerated access patterns targeting order or payment resource identifiers.
Web server access logs showing successful 200 OK responses on endpoints that normally require authentication.

Detection Strategies

Review Drupal watchdog and web server logs for direct requests to Commerce PayPal paths without a valid session cookie.
Correlate PayPal IPN or return URL traffic with legitimate checkout sessions to surface forged or replayed requests.
Deploy web application firewall rules that flag unauthenticated access to payment callback endpoints.

Monitoring Recommendations

Continuously monitor for spikes in traffic to Commerce PayPal routes and alert on volumetric or enumeration patterns.
Track and alert on order state transitions performed by anonymous or unexpected sessions.
Ingest Drupal application logs into a centralized SIEM and build detections around authorization failure and success ratios.

How to Mitigate CVE-2026-73475

Immediate Actions Required

Upgrade Commerce PayPal to a fixed release above 1.12.0 for the 1.x branch or above 2.1.3 for the 2.x branch as directed in the Drupal advisory.
Audit web server and Drupal logs for prior unauthorized access to Commerce PayPal endpoints.
Restrict external access to payment callback routes to known PayPal IP ranges where operationally feasible.

Patch Information

Refer to the Drupal Security Advisory SA-CONTRIB-2026-095 for fixed versions and upgrade guidance. Administrators should update the Commerce PayPal module to the latest supported release for their branch and clear Drupal caches after upgrading.

Workarounds

Temporarily disable the Commerce PayPal module until the site is upgraded if PayPal functionality is not business-critical.
Apply WAF rules blocking unauthenticated requests to Commerce PayPal controller paths.
Enforce reverse proxy access controls limiting exposure of payment callback endpoints to trusted networks.

bash

# Configuration example
# Upgrade the Commerce PayPal module using Composer, then apply database updates
composer update drupal/commerce_paypal --with-dependencies
drush updatedb -y
drush cache:rebuild