DRUPAL-CONTRIB-2026-324: Composer/drupal/commerce_license vulnerability

Q: Which sites are realistically exposed to this issue?

Sites using composer/drupal/commerce_license are exposed only if they allow license order items to be modified outside the standard cart form. The advisory states that this condition mitigates the vulnerability.

Q: What would an attacker need to do to exploit it?

A customer would need a way to modify license order items outside the standard cart form. Under those conditions, insufficient validation could allow the customer to obtain a license without paying its full price.

Published Nov 11, 2026

Updated

This module enables you to sell licenses (such as roles or files) using Drupal Commerce.

The module doesn't sufficiently validate license order items, which under certain conditions could allow a customer to obtain a license without paying its full price.

This vulnerability is mitigated by the fact that the site must expose order items to modification outside of the standard cart form.

Affected Software

1 affected componentFixes available

composer/drupal/commerce_license<3.1.2

3.1.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/commerce_license to a version that resolves this vulnerability.
Fixed in 3.1.2

Event History

Nov 11, 2026

Advisory Published

via OSV·05:48 PM

Data Sourced

via OSV·05:48 PM

DescriptionAffected Software

Frequently Asked Questions

Which sites are realistically exposed to this issue?

Sites using composer/drupal/commerce_license are exposed only if they allow license order items to be modified outside the standard cart form. The advisory states that this condition mitigates the vulnerability.

What would an attacker need to do to exploit it?

A customer would need a way to modify license order items outside the standard cart form. Under those conditions, insufficient validation could allow the customer to obtain a license without paying its full price.

DRUPAL-CONTRIB-2026-324: Composer/drupal/commerce_license vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which sites are realistically exposed to this issue?

What would an attacker need to do to exploit it?

Company

Resources

Contact

Frequently Asked Questions

Which sites are realistically exposed to this issue?

What would an attacker need to do to exploit it?