Product:
Adobe Commerce
Summary
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation requires user interaction, as a victim must visit a maliciously crafted URL or interact with a compromised web page.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.3 | CVE-2026-34656 |
Exploitation
To exploit this vulnerability, an attacker must trick a user into visiting a specially crafted URL or interacting with a compromised web page. Once the user engages with the malicious content, the attacker can bypass security measures and gain unauthorized write access to the system.
Affected Products
- Adobe Commerce 2.4.9-beta1
- Adobe Commerce 2.4.8-p4
- Adobe Commerce 2.4.7-p9
- Adobe Commerce 2.4.6-p14
- Adobe Commerce 2.4.5-p16
- Adobe Commerce 2.4.4-p17
Mitigation
To mitigate this vulnerability, users should ensure they are using the latest version of Adobe Commerce and apply any available security patches. Additionally, users should be cautious when clicking on links or interacting with web pages from untrusted sources.