Product:
Adobe Commerce
Summary
Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized access to a feature. Exploitation of this issue does not require user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.3 | CVE-2026-21285 |
Exploitation
An attacker with low privileges can exploit this vulnerability by sending specially crafted requests to the affected Adobe Commerce application. Since the vulnerability allows for a security feature bypass, the attacker can gain unauthorized access to certain features without needing any user interaction, making it easier to exploit.
Affected Products
- Adobe Commerce 2.4.9-alpha3: Affected by Incorrect Authorization vulnerability.
- Adobe Commerce 2.4.8-p3: Affected by Incorrect Authorization vulnerability.
- Adobe Commerce 2.4.7-p8: Affected by Incorrect Authorization vulnerability.
- Adobe Commerce 2.4.6-p13: Affected by Incorrect Authorization vulnerability.
- Adobe Commerce 2.4.5-p15: Affected by Incorrect Authorization vulnerability.
- Adobe Commerce 2.4.4-p16: Affected by Incorrect Authorization vulnerability.
Mitigation
To mitigate this vulnerability, users should update their Adobe Commerce installations to the latest version that addresses the Incorrect Authorization issue. Regularly applying security patches and updates is essential to protect against such vulnerabilities.