{"id":"DRUPAL-CONTRIB-2026-260","details":"This module enables you to sell licenses granting access to resources, such as user roles, files, or protected content.\n\nThe module doesn't sufficiently restrict access to license fields for users with the \"update own commerce\\_license\" permission. A license owner can change the rights granted by their license and the license state, which can result in privilege escalation, up to the Administrator role for the site.\n\nThis vulnerability is mitigated by the fact that an attacker must own a license, and have a role with the \"update own commerce\\_license\" permission, which is not granted by default.","aliases":["CVE-2026-118555"],"modified":"2026-10-28T18:15:04.340234581Z","published":"2026-10-28T16:56:16Z","references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-260"}],"affected":[{"package":{"name":"drupal/commerce_license","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/commerce_license?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1"}],"database_specific":{"constraint":"\u003c3.1.1"}}],"database_specific":{"affected_versions":"\u003c3.1.1","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/commerce_license/DRUPAL-CONTRIB-2026-260.json"}}],"schema_version":"1.9.2","credits":[{"name":"Marcus Johansson (marcus_johansson)","contact":["https://www.drupal.org/u/marcus_johansson"]}]}