Product:
Adobe Commerce
Summary
Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized access to a feature. Exploitation of this issue does not require user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.3 | CVE-2026-21297 |
Exploitation
To exploit this vulnerability, an attacker with low privileges can send specially crafted requests to the affected Adobe Commerce application. By doing so, they can bypass security measures and gain unauthorized access to certain features without needing any user interaction.
Affected Products
- Adobe Commerce 2.4.9-alpha3: Affected by an Incorrect Authorization vulnerability.
- Adobe Commerce 2.4.8-p3: Vulnerable to security feature bypass.
- Adobe Commerce 2.4.7-p8: Exposed to unauthorized access risks.
- Adobe Commerce 2.4.6-p13: Contains a security flaw allowing feature bypass.
- Adobe Commerce 2.4.5-p15: Vulnerable to exploitation by low-privileged attackers.
- Adobe Commerce 2.4.4-p16: Affected by the same security issue.
Mitigation
To mitigate this vulnerability, it is recommended that users upgrade to the latest version of Adobe Commerce. Regularly applying security patches and updates can help protect against such vulnerabilities. Additionally, implementing strict access controls can reduce the risk of unauthorized access.