SA-CONTRIB-2026-260: Critical severity composer/drupal/commerce_license vulnerability
This module enables you to sell licenses granting access to resources, such as user roles, files, or protected content. The module doesn't sufficiently restrict access to license fields for users with the "update own commercelicense" permission. A license owner can change the rights granted by their license and the license state, which can result in privilege escalation, up to the Administrator role for the site. This vulnerability is mitigated by the fact that an attacker must own a license, and have a role with the "update own commercelicense" permission, which is not granted by default.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/commerce_licenseto a version that resolves this vulnerability.Fixed in 3.1.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users who both own a license and have a role with the "update own commerce_license" permission are exposed. That permission is not granted by default.
What must an attacker be able to do to exploit it?
An attacker must own a license and be allowed to update their own commerce_license entity. They can then alter the rights granted by that license and its state.
What is the potential impact?
A license owner may escalate privileges by modifying their license, potentially gaining the site's Administrator role.