CVE-2026-118555

Name of the Vulnerable Software and Affected Versions Drupal Commerce License versions 0.0.0 through 3.1.1

Description An incorrect authorization issue allows forceful browsing. The module does not sufficiently restrict access to license fields for users possessing the update own commerce license permission. Consequently, a license owner can modify the license state and the rights granted by their license, potentially leading to privilege escalation up to the Administrator role.

Recommendations Update Drupal Commerce License to a version later than 3.1.1. Restrict the assignment of the update own commerce license permission to minimize the risk of unauthorized privilege escalation.