Adobe Commerce and Magento Open Source Incorrect Authorization Vulnerability Allowing Security Feature Bypass

A vulnerability allowing security feature bypass has been identified in Adobe Commerce and Magento Open Source. This issue affects versions through 2.4.8, as well as several earlier patch versions. The vulnerability arises from incorrect authorization, enabling a high-privileged attacker to bypass security measures and gain limited unauthorized access. Notably, exploitation of this vulnerability does not require user interaction.

Impact

Exploitation of this vulnerability could lead to a security feature bypass, allowing unauthorized access to certain functionalities or data.

Remediation

Users are advised to update to Adobe Commerce or Magento Open Source version 2.4.9-alpha1, 2.4.8-p1 for 2.4.8, 2.4.7-p6 for 2.4.7-p5 and earlier, 2.4.6-p11 for 2.4.6-p10 and earlier, or 2.4.5-p13 for 2.4.5-p12 and earlier. Instructions for updating can be found in the 2.4.x release notes.