Is CVE-2026-126732 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126732 being exploited in the wild.

How severe is CVE-2026-126732?

Informational severity, published 11 November 2026.

How is CVE-2026-126732 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-126732?

Check whether you run Drupal Commerce License or Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce License at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126732: Drupal Commerce License access bypass in license validation

CVE-2026-126732 · Severity: info · Published 2026-11-11

Drupal's Commerce License module, which sells digital licenses granting access to roles and resources through an e-commerce system, fails to properly validate which license an order item references. An attacker can manipulate this to take over another user's license. However, the attack is mitigated by default because JSON:API and REST write access to order items are disabled by default in Drupal.

Technologies: Drupal Commerce License, Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce License. Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-126732 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126732 being exploited in the wild.
How severe is CVE-2026-126732?: Informational severity, published 11 November 2026.
Which products and versions are affected?: Drupal Commerce License before 3.1.2; Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce License ECOSYSTEM:introduced=0,fixed=3.1.2.
Is there a fix for CVE-2026-126732?: Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce License: upgrade to 3.1.2 or later. Until then: Do not enable JSON:API or REST write access to order items unless absolutely necessary, as this is not the default Drupal configuration. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126732 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-126732?: Check whether you run Drupal Commerce License or Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce License at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce License: upgrade to 3.1.2 or later

Do not enable JSON:API or REST write access to order items unless absolutely necessary, as this is not the default Drupal configuration.

Technical details

The Commerce License module does not sufficiently validate the license referenced by order items, allowing an attacker to modify an order item to reference a license owned by another user. This access bypass requires that JSON:API or REST be explicitly configured to allow write operations on order items—a non-default configuration. The attack grants unauthorized access to resources (such as roles) controlled by the compromised license.

Affected products

Drupal Commerce License before 3.1.2

Identifiers

CVE-2026-126732
DRUPAL-CONTRIB-2026-323

Timeline

2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.