View online: https://www.drupal.org/sa-contrib-2026-260 Project: Commerce License [1] Project machine name: commerce_license Date: 2026-October-27 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <3.1.1 CVE IDs: CVE-2026-118555 Description: This module enables you to sell licenses granting access to resources, such as user roles, files, or protected content. The module doesn't sufficiently restrict access to license fields for users with the "update own commerce_license" permission. A license owner can change the rights granted by their license and the license state, which can result in privilege escalation, up to the Administrator role for the site. This vulnerability is mitigated by the fact that an attacker must own a license, and have a role with the "update own commerce_license" permission, which is not granted by default. Solution: Install the latest version: * If you use the Commerce License module for Drupal 10 or 11, upgrade to Commerce License 3.1.1 [3]. Sites that granted the "update own commerce_license" permission should review role licenses for unexpected roles, and review which users hold administrative roles. Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Jonathan Sacksick (jsacksick) [5] * Tom Ashe (tomtech) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Jess (xjm) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/commerce_license [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/commerce_license/releases/3.1.1 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/jsacksick [6] https://www.drupal.org/u/tomtech [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/xjm [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....