{"id":"CVE-2026-118555","aliases":["DRUPAL-CONTRIB-2026-260","EUVD-2026-113512","GHSA-jv69-g96x-2r4w"],"status":"published","title":"Commerce License - Moderately critical - Access bypass - SA-CONTRIB-2026-260","description":"Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00198,"percentile":0.0967,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-10-28T16:56:16Z","modified":"2026-11-06T13:56:41Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/commerce_license","fixed_in":["3.1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/commerce_license","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1"}]}]}],"products":[{"vendor":"drupal","product":"commerce license"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-260","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118555","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jv69-g96x-2r4w"},{"url":"https://git.drupalcode.org/project/commerce_license","tags":["web"]},{"url":"https://www.drupal.org/project/commerce_license","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118555.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-118555","title":"Commerce License - Moderately critical - Access bypass - SA-CONTRIB-2026-260","description":"Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1.","status":"published","published":"2026-10-30T03:09:06.783Z","modified":"2026-11-06T13:56:41.987Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-863"],"updated_at":"2026-11-06T14:58:28.173309Z"}],"euvd":[{"id":"EUVD-2026-113512","description":"Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1.","status":"published","published":"2026-10-30T03:09:06Z","modified":"2026-11-06T13:56:41Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-06T15:05:10.688381Z"}],"ghsa":[{"id":"GHSA-jv69-g96x-2r4w","title":"Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This...","description":"Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1.","status":"published","published":"2026-10-30T06:31:58Z","modified":"2026-11-06T15:32:21Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-06T16:00:41.773289Z"}],"nvd":[{"id":"CVE-2026-118555","description":"Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1.","status":"published","published":"2026-10-30T04:18:20.97Z","modified":"2026-11-06T14:17:07.227Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-06T16:00:35.469074Z"}],"osv":[{"id":"CVE-2026-118555","title":"Commerce License - Moderately critical - Access bypass - SA-CONTRIB-2026-260","description":"Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1.","status":"published","published":"2026-10-30T03:09:06.783Z","modified":"2026-11-08T02:30:41.240918011Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-07T03:08:01.41647Z"},{"id":"DRUPAL-CONTRIB-2026-260","description":"This module enables you to sell licenses granting access to resources, such as user roles, files, or protected content.\n\nThe module doesn't sufficiently restrict access to license fields for users with the \"update own commerce\\_license\" permission. A license owner can change the rights granted by their license and the license state, which can result in privilege escalation, up to the Administrator role for the site.\n\nThis vulnerability is mitigated by the fact that an attacker must own a license, and have a role with the \"update own commerce\\_license\" permission, which is not granted by default.","status":"published","published":"2026-10-28T16:56:16Z","modified":"2026-10-28T18:15:04.340234581Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}