Adobe Commerce and Magento Open Source Incorrect Authorization Vulnerability Allowing Unauthorized Read Access

A vulnerability allowing incorrect authorization has been identified in Adobe Commerce and Magento Open Source. This issue affects several versions, including Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier, as well as Magento Open Source versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14 and earlier. The vulnerability allows attackers to bypass security measures and gain unauthorized read access, without requiring user interaction.

Impact

Exploitation of this vulnerability could lead to unauthorized read access, allowing attackers to bypass security measures and access sensitive information.

Remediation

Users are advised to update to the latest versions of Adobe Commerce or Magento Open Source. Instructions for updating can be found in the Adobe Security Bulletin APSB25-94.