Threats tagged 'drupal-contrib-2026-260'

The Drupal Commerce License module has a vulnerability that allows license owners with the 'update own commerce_license' permission to modify license fields improperly. This can lead to privilege escalation, potentially granting Administrator role access. The vulnerability affects versions prior to 3.1.1 and requires the attacker to already own a license and have the specific permission, which is not granted by default.