Adobe Commerce Improper Authorization Vulnerability Allowing Security Feature Bypass

A vulnerability allowing improper authorization has been identified in Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier. This vulnerability could lead to a security feature bypass, allowing an attacker to gain unauthorized write access. Exploitation requires user interaction, as a victim must visit a maliciously crafted URL or engage with a compromised web page.

Impact

Exploitation of this vulnerability could result in unauthorized write access, allowing attackers to bypass security measures and potentially manipulate data or application behavior.

Remediation

Users are advised to update to Adobe Commerce versions 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17 or 2.4.4-p18. Instructions for updating can be found in the Adobe Commerce 2.4.x Release Notes.