SA-CONTRIB-2026-323: Critical severity composer/drupal/commerce_license vulnerability
This module enables you to sell licenses that grant access to resources (such as roles) through Drupal Commerce. The module doesn't sufficiently validate the license referenced by an order item, allowing an attacker to take over another user's license. This vulnerability is mitigated by the fact that JSON:API or REST must be configured to allow writes to order items, which is not the default.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/commerce_licenseto a version that resolves this vulnerability.Fixed in 3.1.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using composer/drupal/commerce_license are exposed if JSON:API or REST has been configured to permit write access to order items. This write access is not enabled by default.
What does an attacker need to exploit the issue?
An attacker needs the ability to submit writes to order items through JSON:API or REST and to reference another user's license. Insufficient validation can then allow takeover of that license.
How can I determine whether my site is affected?
Check whether composer/drupal/commerce_license is installed and whether JSON:API or REST permits write operations on order items. If order-item writes are not allowed through those interfaces, the described mitigation applies.
What can be done if patching is not immediately possible?
Disable or restrict JSON:API and REST write access to order items. This removes the configuration condition required for exploitation.