🔐 CVE Alert

CVE-2026-118555

UNKNOWN 0.0

Commerce License - Moderately critical - Access bypass - SA-CONTRIB-2026-260

CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th

Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1.

CWE CWE-863
Vendor drupal
Product commerce license
Ecosystems
Industries
WebMedia
Published Oct 30, 2026
Stay Ahead of the Next One

Get instant alerts for drupal commerce license

Be the first to know when new unknown vulnerabilities affecting drupal commerce license are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Drupal / Commerce License
0.0.0 < 3.1.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗
drupal.org: https://www.drupal.org/sa-contrib-2026-260

Credits

Marcus Johansson (marcus_johansson) Jonathan Sacksick (jsacksick) Tom Ashe (tomtech) Swan Kalata (akalata) Greg Knaddison (greggles) Jess (xjm)