Improper access control in Commerce Escrow - CVE-2026-122071
Published: November 5, 2026
Vulnerability identifier: #VU159422
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-122071
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to the affected module does not sufficiently verify incoming Escrow.com webhook notifications. A remote attacker can forge payment and order status updates to mark unpaid orders as paid or completed or cancel orders that are in progress.
Affected software
Commerce Escrow
How to mitigate CVE-2026-122071
Install updates from vendor's website.
Commerce Escrow - update to 1.1.0