CVE-2026-126733: Composer/drupal/commerce_license vulnerability
This module enables you to sell licenses (such as roles or files) using Drupal Commerce.
The module doesn't sufficiently validate license order items, which under certain conditions could allow a customer to obtain a license without paying its full price.
This vulnerability is mitigated by the fact that the site must expose order items to modification outside of the standard cart form.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/commerce_licenseto a version that resolves this vulnerability.Fixed in 3.1.2
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites using composer/drupal/commerce_license are affected only when they expose license order items to modification outside the standard cart form. The standard cart form does not meet the stated condition for exploitation.
What must an attacker be able to do to exploit it?
A customer must be able to modify license order items through a path outside the standard cart form. Under those conditions, insufficient validation could let them obtain a license without paying the full price.
How can I assess whether my site may be affected?
Review whether customers can alter license order items anywhere other than the standard cart form. If no such modification path is exposed, the described mitigation applies.