Magento Commerce Improper Authorization Vulnerability Could Lead To Information Exposure

Vulnerability

An improper authorization vulnerability exists in Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier). The flaw resides in the authorization logic, which fails to properly validate permissions for certain actions or resources, potentially allowing a privileged attacker to bypass access controls. The affected versions are explicitly listed in the official description [1].

Exploitation

To exploit this vulnerability, an attacker must have valid authentication credentials for the Magento Commerce instance. No additional privileges beyond standard authenticated access appear to be required. The attacker can then send crafted requests to endpoints that are protected by the flawed authorization mechanism, thereby gaining unauthorized access to resources or data [1].

Impact

Successful exploitation leads to the disclosure of sensitive information. The nature of the compromised data is not specified in the available references, but it could include customer details, order information, or other confidential business data. The attacker's privilege level remains that of an authenticated user, but the breach violates the intended access controls for sensitive information [1].

Mitigation

Adobe has released security updates to address this vulnerability. Users should upgrade to Magento Commerce versions 2.4.3, 2.4.2-p2, or 2.3.7-p1 (or later), depending on their release line. No workarounds have been publicly disclosed. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog [1].