Live › vulnerability › CVE-2026-118555
Drupal Commerce License has an incorrect authorization flaw that lets a user reach pages they should not see by forceful browsing. The sources list affected versions from 0.0.0 through 3.1.1 and state no severity or fix.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that run the Commerce License module, which sells license-based access to content or products, are exposed. The sources do not say which configurations or roles are needed to reach the restricted pages, so exposure beyond the affected version range is unknown.
No product ranges from the sources yet.
drush pm:list --filter=commerce_license or the composer show drupal/commerce_license command.0.0.0 to 3.1.1.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-118555")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.