Adobe Commerce | Incorrect Authorization (CWE-863)

Vulnerability

Overview

The vulnerability is an Incorrect Authorization issue in Adobe Commerce that affects versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13, and earlier [1]. The root cause lies in improper enforcement of authorization checks for certain high-privilege actions, allowing a security feature bypass [1].

Exploitation

Exploitation requires a high-privileged attacker, such as an administrator or other user with elevated roles [1]. The attack does not require any user interaction, lowering the barrier for successful exploitation. The exact attack vector is not detailed in public advisories, but the flaw likely allows the attacker to invoke functions or access resources that should be restricted even for privileged accounts.

Impact

Successful exploitation enables the attacker to bypass intended security controls and gain limited unauthorized access [1]. This limited access could include reading sensitive data or performing certain actions beyond their authorized scope. However, the impact is described as limited, suggesting full remote code execution or complete system compromise is not achieved through this vulnerability alone [1].

Mitigation

Adobe has not yet released a security patch specifically cited for this CVE. The affected versions are widely used in production e-commerce environments [2]. Adobe Commerce customers should monitor Adobe's security bulletin page and apply any available updates promptly. Because no workaround is documented, updating to a patched version (once released) is the recommended mitigation [1].