EUVD-2026-99218
GHSA-mrw7-948w-cg2x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach internet-facing Commerce endpoint
-
ExploitSend request bypassing authorization check
-
ExecutionObtain unauthorized read access
-
ImpactPerform limited unauthorized writes
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated exploitation with no user interaction against a reachable Adobe Commerce, Adobe Commerce B2B, or Magento Open Source instance - i.e., an internet-facing storefront or admin interface. The description does not name a specific feature toggle or non-default configuration as a prerequisite, so the primary limiting factors are: the instance must be network-reachable by the attacker, and it must be running an affected, unpatched version. Impact is bounded - unauthorized read and only 'limited write' access (C:L/I:L, A:N) - so this is a security-feature/authorization bypass rather than full administrative takeover or data destruction. |
| Impact | This is a genuine but mid-tier priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) indicates a network-reachable, low-complexity, unauthenticated flaw with a changed scope, which is why it rates HIGH despite only LOW confidentiality and integrity impact and no availability impact. The elevated score is driven largely by PR:N and S:C rather than by severe impact - unauthorized read and 'limited write' access, not full compromise or RCE. No EPSS score, no CISA KEV listing, and no public POC were supplied in the intelligence, so there is no signal of active or probable near-term exploitation to corroborate the theoretically high exploitability; absence of these is not proof of safety but means exploitation is not confirmed. The signals are internally consistent (network vector matches a web e-commerce platform; incorrect-authorization CWE-863 matches the 'security feature bypass' description), so there is no CVSS-versus-description conflict to flag. Net: patch on a normal-to-expedited cycle because it is unauthenticated and affects a high-footprint platform, but it is not an emergency on par with an unauthenticated RCE or a KEV-listed bug. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends crafted requests to an internet-facing Adobe Commerce/Magento storefront or admin endpoint that fails to correctly enforce authorization, bypassing an intended security control to read data they should not see and make limited unauthorized writes. Because scope is changed, the impact can extend beyond the directly vulnerable component to other resources in the deployment. No public exploit code was identified in the provided data, and no user interaction is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Incorrect authorization in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source lets remote, unauthenticated attackers bypass security controls to gain unauthorized read access plus limited write access, with no user interaction required. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (base 7.2) confirms the attacker needs no credentials and only network reachability to an affected, unpatched instance - typically an internet-facing storefront, REST/GraphQL API, or admin interface - while the changed scope (S:C) indicates the bypass can reach resources outside the vulnerable component's own security boundary. Impact is bounded rather than catastrophic: confidentiality and integrity are Low and availability is None, so this is a security-feature/authorization bypass rather than full administrative takeover or data destruction, and no public exploit code has been identified at time of analysis, making this a genuine but mid-tier priority.
RemediationAI
Apply the fixed release published in Adobe's security bulletin APSB26-153 (https://www.adobe.com/trust/security/products/commerce/apsb26-153.html) for Adobe Commerce, Adobe Commerce B2B, and Magento Open Source; the supplied intelligence does not include an exact patched version number, so the bulletin must be consulted to map each deployed release line to its corresponding fixed build, and the same fix should be applied to B2B and Open Source instances sharing the platform. No public exploit code has been identified at time of analysis, so this is not an emergency out-of-band patch, but the unauthenticated, no-interaction nature of the flaw shortens the window in which a proof-of-concept could appear. Where immediate patching is not possible, compensating controls should target the reachable authorization surface: block or allow-list access to administrative and API endpoints (REST/GraphQL) at the edge so only known clients and networks can reach them, accepting the operational cost of breaking integrations that rely on public API exposure; place the admin interface behind a VPN, IP allow-list, or an additional authentication layer such as HTTP basic auth or an identity-aware proxy, with the trade-off of added latency and possible breakage of automated admin tooling; disable unused B2B modules and GraphQL/REST endpoints via web server routing rules, accepting that any dependent storefront features will stop working; and deploy WAF signatures that flag anomalous enumeration, unusual data reads, or state-changing requests originating from clients with no established session, recognizing that generic WAF coverage of authorization flaws is inherently partial. Because impact is limited to unauthorized reads and limited writes with no availability loss, monitoring for unexpected data egress and unexpected low-privilege writes across catalog, order, and customer data is a reasonable detection backstop until the patch is applied.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-863 (Incorrect Authorization): the application fails to correctly enforce which authenticated identity or role is permitted to perform a given action or read a given resource, so an attacker can reach functionality or data that the authorization logic was supposed to gate. Adobe Commerce and Adobe Commerce B2B are Adobe's commercial PHP e-commerce platforms, and Magento Open Source is the upstream community edition sharing the same framework, ACL/role system, REST and GraphQL APIs, and admin surface - which is why a single authorization defect maps to all three CPEs (adobe_commerce, adobe_commerce_b2b, magento_open_source). The CVSS vector's changed scope (S:C) is significant: it means the bypassed authorization check protects assets managed by a different security authority than the vulnerable component, consistent with a flaw in an access-control layer that lets one module, API route, or store view act on resources belonging to another. The vector's PR:N and UI:N mean exploitation is unauthenticated and requires no victim interaction - the attacker only needs the authorization decision itself to be wrong, not a valid session or a tricked user. The supplied CPE strings use wildcard versions, so the data does not pin an exact affected version range; Adobe's advisory APSB26-153 is the authoritative source for both the fixed versions and the precise affected releases.
Know when Adobe Commerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Web-facing platform with no stated authentication or interaction gives AV:N/AC:L/PR:N/UI:N; authorization bypass crossing a trust boundary gives S:C; impact is partial read/write (C:L/I:L) with no availability loss.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction. Scope is changed.
Executive ViewAI
Adobe Commerce, Adobe Commerce B2B, and Magento Open Source are affected by a high-severity authorization bypass that allows unauthenticated attackers to read and lightly modify data on internet-facing storefronts or APIs. Although no public exploit identified at time of analysis, the flaw requires no credentials or user interaction, potentially exposing customer information and undermining trust in e-commerce operations. Leadership should prioritize mitigation because these platforms often handle sensitive transactions and personal data, and a breach could lead to regulatory scrutiny and reputational damage.
No vendor-released patch identified at time of analysis. Interim mitigations include network segmentation, restricting access to affected instances via IP allowlisting, implementing additional authentication and authorization checks at the edge (e.g., WAF, API gateway), monitoring for anomalous read/write activity, and applying least privilege principles. Consider temporarily disabling non-essential API endpoints until a patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Adobe Commerce
View allServer-side template injection in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows remote unauthentica
Arbitrary code execution in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Adobe Commerce Webhooks Plu
SQL injection in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin allows
Security feature bypass in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks plug
Unauthenticated remote code execution affects Adobe Commerce, Adobe Commerce B2B, and Magento Open Source through improp
Remote, low-complexity code execution is possible in Adobe Commerce, Adobe Commerce B2B and Magento Open Source through
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Inj
Stored cross-site scripting in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows a remote attacker to p
Stored cross-site scripting (XSS) in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows an attacker who
Arbitrary code execution in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plu
Arbitrary code execution is achievable in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source by an attacker who
Stored cross-site scripting in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source lets a low-privileged authent
Exploit-DB