SA-CONTRIB-2026-324: Critical severity composer/drupal/commerce_license vulnerability
This module enables you to sell licenses (such as roles or files) using Drupal Commerce. The module doesn't sufficiently validate license order items, which under certain conditions could allow a customer to obtain a license without paying its full price. This vulnerability is mitigated by the fact that the site must expose order items to modification outside of the standard cart form.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/commerce_licenseto a version that resolves this vulnerability.Fixed in 3.1.2
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites using composer/drupal/commerce_license are exposed only if they allow customers to modify license order items outside the standard cart form. The advisory identifies that condition as required mitigation.
What must an attacker be able to do to exploit it?
The attacker must be able to modify license order items through a path outside the standard cart form. Under those conditions, insufficient validation may let them obtain a license without paying the full price.
What should be reviewed while remediation is pending?
Review all customer-accessible workflows, forms, and endpoints that permit modification of license order items outside the standard cart form. Restrict or disable those modification paths where possible.