CVE-2026-73475

Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3.

  • Published Sep 2, 2026
  • CVSS 9.1 critical
  • 0.4% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-73475 at the National Vulnerability Database