Adobe Commerce and Magento Open Source Incorrect Authorization Vulnerability Allowing Security Feature Bypass

A vulnerability allowing incorrect authorization has been identified in Adobe Commerce and Magento Open Source. This issue affects several versions, including Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier, as well as Magento Open Source versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15 and earlier. The vulnerability could lead to a security feature bypass, allowing a low-privileged attacker to gain unauthorized access to limited data. Exploitation does not require user interaction.

Impact

Exploitation of this vulnerability could bypass security measures, allowing unauthorized access to certain data.

Remediation

Users are advised to update to the latest version of Adobe Commerce or Magento Open Source. Instructions for updating can be found in the Adobe Security Bulletin APSB26-05.