Adobe Commerce and Magento Open Source Incorrect Authorization Vulnerability Allowing Unauthorized Read Access

A vulnerability allowing incorrect authorization has been identified in Adobe Commerce and Magento Open Source. This issue affects several versions, including Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier, as well as Magento Open Source versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14 and earlier. The vulnerability allows an attacker to bypass security measures and gain limited unauthorized read access, without requiring user interaction.

Impact

Exploitation of this vulnerability could lead to unauthorized read access, allowing attackers to access sensitive information they should not be privy to.

Remediation

Users are advised to update to the latest versions of Adobe Commerce or Magento Open Source. Instructions for updating can be found in the Adobe Security Bulletin APSB25-94.