Adobe Commerce Incorrect Authorization Security feature bypass

CVE-2023-22248 is an Incorrect Authorization vulnerability in Adobe Commerce affecting versions 2.4.6, 2.4.5-p2, 2.4.4-p3, and earlier. The root cause lies in improper enforcement of access controls, which allows a security feature bypass [1].

Exploitation does not require user interaction, meaning an attacker can trigger the vulnerability remotely without any user action. The attack surface is likely network-based, although the specific vector is not detailed beyond authorization flaws [1]. No authentication is needed for exploitation.

The impact is information disclosure: an attacker can leak another user's data by exploiting the incorrect authorization. This could expose sensitive customer or order information stored in the Commerce platform [1].

Adobe has not released a patch at the time of writing, but users are advised to monitor security updates and apply patches when available. The vulnerabilities affect both Adobe Commerce and Magento Open Source, as the latter shares codebase [2].