CVE-2026-118555

Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1...

EUVD-2026-113512

Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1...

CVE-2026-118555

The Drupal Commerce License module (versions 0.0.0 to 3.1.1 ) contains an Incorrect Authorization vulnerability (CWE-863) that allows for Forceful Browsing . The root cause is insufficient restriction of access to license fields for users possessing the update own commerce_license permission. A l...

PT-2026-130584

This module enables you to sell licenses granting access to resources, such as user roles, files, or protected content. The module doesn't sufficiently restrict access to license fields for users with the "update own commerce license" permission. A license owner can change the rights granted by...