CVE-2026-118555

Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1...

EUVD-2026-113512

Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1...

CVE-2026-118555

The Drupal Commerce License module (versions 0.0.0 to 3.1.1 ) contains an Incorrect Authorization vulnerability (CWE-863) that allows for Forceful Browsing . The root cause is insufficient restriction of access to license fields for users possessing the update own commerce_license permission. A l...