{"id":"CVE-2026-118555","kind":"vulnerability","aliases":["CVE-2026-118555"],"related":[],"title":"Drupal Commerce License: incorrect authorization lets users browse restricted pages","description":"Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1.","summary":"Drupal Commerce License has an incorrect authorization flaw that lets a user reach pages they should not see by forceful browsing. The sources list affected versions from 0.0.0 through 3.1.1 and state no severity or fix.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["commerce-license","drupal","ecommerce","package"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed Commerce License version with `drush pm:list --filter=commerce_license` or the `composer show drupal/commerce_license` command.\n- Compare the result with the affected range, `0.0.0` to `3.1.1`.","fix":null,"status":"open","published_at":"2026-10-30T04:18:20+00:00","first_seen_at":"2026-10-30T04:28:38+00:00","triaged_at":"2026-10-30T04:29:23+00:00","updated_at":"2026-10-30T04:29:23+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:29:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Drupal Commerce License: incorrect authorization lets users browse restricted pages","impact":"medium","summary":"Drupal Commerce License has an incorrect authorization flaw that lets a user reach pages they should not see by forceful browsing. The sources list affected versions from 0.0.0 through 3.1.1 and state no severity or fix.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","commerce-license","ecommerce"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users read restricted pages or licensed content","analyst_note":"Check the NVD entry and the Drupal security advisory for the fixed version, the required role or configuration, and what content is exposed.","how_to_check":"- Check the installed Commerce License version with `drush pm:list --filter=commerce_license` or the `composer show drupal/commerce_license` command.\n- Compare the result with the affected range, `0.0.0` to `3.1.1`.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that run the Commerce License module, which sells license-based access to content or products, are exposed. The sources do not say which configurations or roles are needed to reach the restricted pages, so exposure beyond the affected version range is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000671,"input_tokens":4078,"output_tokens":526,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118555':13A,16A '-2026':12A,15A '0.0.0':50B,76C '3.1.1':52B,78C 'affect':47B,71C 'allow':66C 'author':5A,29B,60C 'brows':8A,43B,68C 'commerc':2A,18B,24B,64C,72C 'commerce-licens':17B 'cve':11A,14A 'drupal':1A,20B,23B,63C 'ecommerc':21B 'fix':58B 'flaw':30B 'forc':42B,67C 'incorrect':4A,28B,59C 'issu':70C 'let':6A,32B 'licens':3A,19B,25B,65C,73C 'list':46B 'packag':22B 'page':10A,36B 'reach':35B 'restrict':9A 'see':40B 'sever':56B 'sourc':45B 'state':54B 'user':7A,34B 'version':48B,74C 'vulner':61C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that run the Commerce License module, which sells license-based access to content or products, are exposed. The sources do not say which configurations or roles are needed to reach the restricted pages, so exposure beyond the affected version range is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118555","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118555","severity":null,"published_at":"2026-10-30T04:18:20+00:00","modified_at":"2026-10-30T04:18:20+00:00","first_seen_at":"2026-10-30T04:28:38+00:00","fetched_at":"2026-10-30T04:28:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}