Product:
Adobe Commerce
Summary
Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized view access of data. Exploitation of this issue does not require user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.3 | CVE-2026-21286 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted requests to the affected Adobe Commerce versions. By doing so, they can bypass security measures in place, allowing them to gain unauthorized access to sensitive data without needing any user interaction.
Affected Products
- Adobe Commerce 2.4.9-alpha3: Affected by an Incorrect Authorization vulnerability.
- Adobe Commerce 2.4.8-p3: Vulnerable to security feature bypass.
- Adobe Commerce 2.4.7-p8: Exposed to unauthorized data access risks.
- Adobe Commerce 2.4.6-p13: Susceptible to exploitation without user interaction.
- Adobe Commerce 2.4.5-p15: Can be exploited to gain limited unauthorized view access.
- Adobe Commerce 2.4.4-p16: Vulnerable to security bypass issues.
Mitigation
To mitigate this vulnerability, users should update their Adobe Commerce installations to the latest versions that address the security flaw. Regularly applying security patches and monitoring for unusual activity can also help protect against potential exploitation.