Commerce Core – Highly critical – Access bypass – SA-CONTRIB-2026-254

Commerce Core insufficiently protects certain routes and entity fields, enabling an access bypass. The vulnerability is actively exploited in the wild and may financially impact the vendor.