- Package
- drupal/commerce_license
- Fixed in
- 3.1.1
- Published
- Wed 28 Oct 2026, 16:56 LisbonUpdated Mon 2 Nov 2026, 07:25 Lisbon
In plain words
A license owner can change the rights granted by their license and its state, potentially gaining privileges up to the site's Administrator role. They must have a role with the update own commerce_license permission, which is not granted by default.
Am I affected?
Look for drupal/commerce_license and its version in composer.lock. The advisory lists 3.1.1 as fixed but gives no affected version range. Check whether any license owners have a role with the update own commerce_license permission.
What to do
Check which version you have, then update to a fixed release for your branch (3.1.1):
composer show drupal/commerce_license | grep versions
composer update drupal/commerce_licenseIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
If you cannot update yet
The vulnerability is mitigated by requiring the attacker to own a license and have a role with the update own commerce_license permission, which is not granted by default.
The advisory's description
This module enables you to sell licenses granting access to resources, such as user roles, files, or protected content.
The module doesn't sufficiently restrict access to license fields for users with the "update own commerce_license" permission. A license owner can change the rights granted by their license and the license state, which can result in privilege escalation, up to the Administrator role for the site.
This vulnerability is mitigated by the fact that an attacker must own a license, and have a role with the "update own commerce_license" permission, which is not granted by default.