Product:
Adobe Commerce
Summary
Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and have limited impact to the integrity and availability of data. Exploitation does not require user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.7 | CVE-2026-21359 |
Exploitation
To exploit this vulnerability, an attacker must find a way to bypass the security measures in place. This may involve manipulating requests or exploiting specific conditions that are outside the attacker’s control. The complexity of the attack is high, requiring a deep understanding of the system and its security features.
Affected Products
- Adobe Commerce 2.4.9-alpha3: Affected by Incorrect Authorization vulnerability.
- Adobe Commerce 2.4.8-p3: Affected by Incorrect Authorization vulnerability.
- Adobe Commerce 2.4.7-p8: Affected by Incorrect Authorization vulnerability.
- Adobe Commerce 2.4.6-p13: Affected by Incorrect Authorization vulnerability.
- Adobe Commerce 2.4.5-p15: Affected by Incorrect Authorization vulnerability.
- Adobe Commerce 2.4.4-p16: Affected by Incorrect Authorization vulnerability.
Mitigation
To mitigate this vulnerability, it is recommended to update to the latest version of Adobe Commerce that addresses the Incorrect Authorization issue. Regularly reviewing and updating security measures can also help prevent exploitation.