CVE-2026-73475

Critical · CVSS 9.1

CVSS: 9.1; nvd
EPSS: 0.23%; 14th pct
KEV: No
Class: oss containerizable; CWE-863

Description

Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3.

Affected packages

Packagist:https://packages.drupal.org/8	drupal/commerce_paypal	0 → 1.12.0
Packagist:https://packages.drupal.org/8	drupal/commerce_paypal	2.0.0 → 2.1.3

References

https://www.drupal.org/sa-contrib-2026-095

Status: profiled · ingested 2026-09-08T18:00:58.000Z