CVE-2026-118555

This module enables you to sell licenses granting access to resources, such as user roles, files, or protected content.

The module doesn't sufficiently restrict access to license fields for users with the "update own commerce_license" permission. A license owner can change the rights granted by their license and the license state, which can result in privilege escalation, up to the Administrator role for the site.

This vulnerability is mitigated by the fact that an attacker must own a license, and have a role with the "update own commerce_license" permission, which is not granted by default.