Threats tagged 'drupal-contrib-2026-323'

The Drupal Commerce License module allows selling licenses granting access to resources like roles. A vulnerability exists due to insufficient validation of the license referenced by an order item, enabling an attacker to take over another user's license. This issue requires JSON:API or REST to be configured to allow writes to order items, which is not the default configuration. The vulnerability is fixed in version 3.1.2.