Adobe Commerce | Incorrect Authorization (CWE-863)

Vulnerability

Description

Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Incorrect Authorization vulnerability. This flaw arises from improper authorization checks within the application, enabling a security feature bypass [1].

Exploitation

An attacker with low privileges can exploit this vulnerability without requiring any user interaction. The attack does not need any special network access or complex prerequisites, making it relatively accessible for a malicious insider or a compromised low-tier account [1].

Impact

Successful exploitation results in a low impact on integrity. This means an attacker could potentially modify certain data or settings in a limited fashion, but not gain full administrative control or access sensitive information. The confidentiality and availability of the system are not directly affected [1].

Mitigation

Adobe has not yet released a patched version, but the vulnerability is acknowledged. Users should monitor Adobe's security advisories and apply updates as soon as they become available. The Magento Open Source project may receive a fix in a future release [2].