Adobe Commerce CVE-2026-48415

Exploitation requires a low-privileged authenticated account on the target Adobe Commerce, Magento Open Source, or Commerce B2B instance (PR:L), but no user interaction and no elevated privileges. The flaw is an incorrect authorization check (CWE-863) that fails to properly restrict access, so once authenticated at any low level an attacker can reach the vulnerable functionality remotely over the network (AV:N/AC:L). Affected deployments are unpatched instances in the 2.4.4 through 2.4.9 lines (and Commerce B2B 1.3.x-1.5.x) prior to the August 2026 patches; the specific feature or endpoint carrying the broken check is not detailed in the advisory. The main limiting factor is the need for a valid low-privileged account rather than fully anonymous access.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L, base 8.3 HIGH) describes a network-reachable, low-complexity flaw needing only low privileges (PR:L) and no user interaction, yielding high confidentiality and integrity impact with limited availability disruption. However, the other signals temper this: EPSS is only 0.35% (28th percentile), and CISA's SSVC framework rates Exploitation as 'none', Automatable 'no', and Technical Impact 'partial' - all pointing to low current real-world exploitation pressure. There is no CISA KEV listing and no public exploit code. The gap between a high 8.3 base score and the weak exploitation/EPSS/SSVC signals indicates this is a genuinely impactful authorization flaw that is NOT yet a widespread active threat - a patch-during-normal-cycle priority rather than an emergency, with the caveat that Magento/Adobe Commerce storefronts are a historically favored, heavily-targeted attacker ecosystem, so the low EPSS could rise once technical details or exploits circulate. The PR:L requirement (a low-privileged account, e.g. a registered customer or B2B company user) is the key real-world limiter.

A low-privileged attacker who holds or registers an ordinary account (such as a customer or B2B portal user) on an Adobe Commerce/Magento storefront sends crafted requests to an endpoint with an incorrect authorization check, bypassing the intended access controls without any user interaction. This grants unauthorized read and write access to data or functionality beyond the account's privilege level, with a limited impact on availability. No public exploit code is identified at time of analysis.