Product:
Adobe Commerce
Summary
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2026-34646 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted requests to the affected Adobe Commerce versions. Since the vulnerability allows for unauthorized write access, the attacker can manipulate data or perform actions without needing any user interaction, making it easier to exploit.
Affected Products
- Adobe Commerce 2.4.9-beta1: Affected by an Incorrect Authorization vulnerability.
- Adobe Commerce 2.4.8-p4: Vulnerable to security feature bypass.
- Adobe Commerce 2.4.7-p9: Exposed to unauthorized write access risks.
- Adobe Commerce 2.4.6-p14: Can be exploited for security bypass.
- Adobe Commerce 2.4.5-p16: Vulnerable to unauthorized actions.
- Adobe Commerce 2.4.4-p17: Affected by the same security issue.
Mitigation
To mitigate this vulnerability, users should update to the latest version of Adobe Commerce that addresses the Incorrect Authorization issue. Regularly applying security patches and updates is essential to protect against such vulnerabilities.