CVE-2026-126732: Composer/drupal/commerce_license vulnerability
This module enables you to sell licenses that grant access to resources (such as roles) through Drupal Commerce.
The module doesn't sufficiently validate the license referenced by an order item, allowing an attacker to take over another user's license.
This vulnerability is mitigated by the fact that JSON:API or REST must be configured to allow writes to order items, which is not the default.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/commerce_licenseto a version that resolves this vulnerability.Fixed in 3.1.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are exposed only if JSON:API or REST is configured to allow write access to order items. This is not the default configuration.
What does an attacker need to do to exploit the issue?
An attacker needs the ability to submit writes to order items through JSON:API or REST. Insufficient validation of the referenced license can then allow takeover of another user's license.
What can be done if the module cannot be updated immediately?
Disable or restrict JSON:API and REST write access to order items. Since such write access is required for exploitation, removing it mitigates the issue.