External risk intelligence

Drupal Commerce PayPal Forceful Browsing Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-73475

This vulnerability affects a payment integration module for Drupal, a common web content management system. Such modules are typically integrated into public-facing e-commerce websites to process online transactions, making the payment endpoint and its associated processing logic directly reachable from the internet as part of normal web application operations.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An incorrect authorization vulnerability has been identified in the Drupal Commerce PayPal module, potentially allowing unauthorized access and modification of data. This issue affects specific versions of the module used within Drupal e-commerce platforms. The main concern is confirming if our organization utilizes this module and is therefore exposed.

Unauthorized access to payment data is possible.
Impacts e-commerce platforms using Drupal.
Confirm module usage and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by navigating directly to specific administrative URLs within a Drupal Commerce site, bypassing necessary checks. This forceful browsing allows access to sensitive payment-related information, potentially leading to unauthorized data retrieval or modification.

No authentication required.
Direct access to administrative pages.
Unauthorized access to sensitive data.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthorized access to specific administrative functions within the Drupal Commerce PayPal module. When supported, an unauthenticated attacker could potentially access or modify certain sensitive order or payment-related information, impacting the integrity of e-commerce operations.

Order and payment data
Via unauthenticated forceful browsing
Compromise of financial integrity

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Drupal Commerce PayPal, likely deployed by e-commerce platform owners and web application teams. The immediate priority is to identify all instances of the affected module, assess their exposure to the internet, and determine business criticality. Once identified, the accountable owner should be located to plan and execute remediation, prioritizing critical or exposed systems.

E-commerce platform owners should own this.
Verify internet-facing instances and criticality.
Plan and coordinate vendor-assisted remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Drupal Commerce PayPal module?

It is a contributed integration for the Drupal content management system that connects e-commerce websites to PayPal payment services. Organizations use it to handle checkout flows, process customer payments, and manage transactional data within their Drupal-based online stores.

How does CVE-2026-73475 create a security weakness?

This vulnerability is classified as Incorrect Authorization (CWE-863). It occurs because the module fails to properly verify if a user has the right permissions to access certain administrative paths, allowing an unauthorized person to view or change sensitive payment information.

Do I need to be logged in to trigger this vulnerability?

No. The flaw permits unauthenticated forceful browsing, meaning an attacker does not need an existing account or password to access the restricted administrative pages. Simply navigating directly to the specific vulnerable URL path is sufficient to bypass security controls.

Why is this CVE considered an external risk?

According to Halo Surface Signal, this module is typically used in public-facing e-commerce websites. Because the payment processing logic and its associated endpoints are designed to be reachable from the internet for normal operations, this flaw is exposed to external access.

What is the first step to address this issue?

You should audit your Drupal environment to determine if the Commerce PayPal module is installed and if the version matches the affected range. Once identified, document which instances are exposed to the internet to prioritize patching or mitigation efforts.

References

www.drupal.org/sa-contrib-2026-095

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.