Adobe Commerce and Magento Open Source Incorrect Authorization Vulnerability Allowing Unauthorized Read Access

A vulnerability allowing incorrect authorization has been identified in Adobe Commerce and Magento Open Source. This issue affects versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier. The vulnerability could lead to a security feature bypass, allowing attackers to gain unauthorized read access. Exploitation does not require user interaction.

Impact

Exploitation of this vulnerability could result in unauthorized read access, bypassing security measures in place.

Remediation

Users are advised to update to Adobe Commerce or Magento Open Source versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, or 2.4.5-p14. Instructions for updating can be found in the 2.4.x release notes.