CVE-2026-126733

This module enables you to sell licenses (such as roles or files) using Drupal Commerce.

The module doesn't sufficiently validate license order items, which under certain conditions could allow a customer to obtain a license without paying its full price.

This vulnerability is mitigated by the fact that the site must expose order items to modification outside of the standard cart form.