DRUPAL-CONTRIB-2026-260

See a problem?
Import Source
https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/commerce_license/DRUPAL-CONTRIB-2026-260.json
JSON Data
https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2026-260
Aliases
  • CVE-2026-118555
Published
2026-10-28T16:56:16Z
Modified
2026-10-28T18:15:04Z
Summary
[none]
Details

This module enables you to sell licenses granting access to resources, such as user roles, files, or protected content.

The module doesn't sufficiently restrict access to license fields for users with the "update own commerce_license" permission. A license owner can change the rights granted by their license and the license state, which can result in privilege escalation, up to the Administrator role for the site.

This vulnerability is mitigated by the fact that an attacker must own a license, and have a role with the "update own commerce_license" permission, which is not granted by default.

References
Credits

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/commerce_license

Package

Name
drupal/commerce_license
Purl
pkg:composer/drupal/commerce_license?repository_url=https:%2F%2Fpackages.drupal.org%2F8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.1.1
Database specific
Show details 
{
    "constraint":  "<3.1.1"
}

Database specific

affected_versions 
"<3.1.1"
source 
"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/commerce_license/DRUPAL-CONTRIB-2026-260.json"