CVE-2026-13238

CVE-2026-13238: Commerce Realex / Global Payments - Moderately critical - Access Bypass - SA-CONTRIB-2026-058

Vendor Drupal

Product Commerce Realex / Global Payments

Weakness CWE-863 · Incorrect authorization

Published July 10, 2026

Last update July 10, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Incorrect Authorization vulnerability in Drupal Commerce Realex / Global Payments allows Forceful Browsing. This issue affects Commerce Realex / Global Payments versions: from 0.0.0 to 3.0.2.

Key dates

02Disclosure timeline

July 10, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-13238 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/863.html AskarLabs — CWE-863 write-up Incorrect Authorization

Related vulnerabilities

04Related CVE

CVE-2025-6003 WordPress Single Sign-On (SSO) - Multiple Versions - Incorrect Authorization to Sensitive Information Exposure CVE-2025-14081 Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting Bypass CVE-2026-2470 Pagelayer <= 2.0.9 - Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts' CVE-2025-12082 CivicTheme Design System - Moderately critical - Information disclosure - SA-CONTRIB-2025-112 CVE-2026-3573 AI (Artificial Intelligence) - Moderately critical - Information Disclosure - SA-CONTRIB-2026-028