Threats tagged 'drupal-contrib-2026-324'

The Drupal Commerce License module allows selling licenses such as roles or files. A vulnerability exists due to insufficient validation of license order items, which could enable a customer to obtain a license without paying the full price. This issue requires that the site exposes order items to modification outside the standard cart form for exploitation. The vulnerability is fixed in version 3.1.2.