Adobe Commerce | Improper Access Control (CWE-284)

This vulnerability is an Improper Access Control issue present in multiple versions of Adobe Commerce and Magento Open Source. The root cause lies in insufficient enforcement of access restrictions, allowing a low-privileged attacker to bypass intended security mechanisms [1].

Exploitation requires only low-privileged access to the application; no user interaction is needed. An attacker can leverage this flaw to perform unauthorized write operations, which implies the ability to modify data or configuration that should be protected [1].

The impact is a security feature bypass resulting in unauthorized write access. This could lead to data corruption, privilege escalation, or further compromise of the e-commerce platform, depending on the exact data the attacker can target [1].

Adobe has released security updates for the affected versions. Users are strongly advised to upgrade to the latest patched releases to mitigate this vulnerability. The advisory does not mention a workaround [1].