commerce_licenseThis module enables you to sell licenses granting access to resources, such as user roles, files, or protected content.
The module doesn't sufficiently restrict access to license fields for users with the "update own commerce_license" permission. A license owner can change the rights granted by their license and the license state, which can result in privilege escalation, up to the Administrator role for the site.
This vulnerability is mitigated by the fact that an attacker must own a license, and have a role with the "update own commerce_license" permission, which is not granted by default.
Install the latest version:
- If you use the Commerce License module for Drupal 10 or 11, upgrade to Commerce License 3.1.1.
Sites that granted the "update own commerce_license" permission should review role licenses for unexpected roles, and review which users hold administrative roles.
- Swan Kalata (akalata) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
