What is the CVSS score of EUVD-2026-56845?

EUVD-2026-56845 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.5%.

Adobe Commerce EUVD-2026-56845

| CVE-2026-48411 MEDIUM

Incorrect Authorization (CWE-863)

2026-08-11 psirt@adobe.com

GHSA-w7m2-g29m-ph87

Authentication Bypass Adobe

6.5

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

6.5 MEDIUM

Exploitation requires high-privilege admin credentials (PR:H); no special conditions beyond authentication; no confidentiality impact is described.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 22:50 vuln.today

CVE Published

Aug 11, 2026 - 18:17 nvd

MEDIUM 6.5

DescriptionCVE.org

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

AnalysisAI

Incorrect Authorization in Adobe Commerce, Magento Open Source, and Adobe Commerce B2B allows a network-accessible, high-privileged attacker to bypass platform security controls and gain unauthorized write access, resulting in high integrity and availability impacts. Affected are Adobe Commerce through 2.4.9-2026-jul, Magento Open Source through 2.4.9-2026-jul, and Adobe Commerce B2B through 1.5.3-2026-jul, with August 2026 patches available per Adobe APSB26-92. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Adobe Commerce and its open-source counterpart Magento are PHP-based e-commerce platforms implementing role-based access control (RBAC) to govern what authenticated administrators may read, write, or configure. CWE-863 (Incorrect Authorization) denotes a failure not in authentication (verifying identity) but in authorization (enforcing what an authenticated identity is permitted to do). Here, an actor already operating at the highest privilege tier can issue requests that the platform's authorization logic fails to correctly gate, permitting write operations to resources or configurations that should be outside that role's authorized scope. The B2B extension adds layered company-account and buyer/seller role constructs, which expand the authorization surface and may be where the boundary enforcement breaks down.

RemediationAI

Apply the August 2026 security patches released by Adobe as documented in APSB26-92 at https://helpx.adobe.com/security/products/magento/apsb26-92.html. For Adobe Commerce, upgrade to 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, or 2.4.4-2026-aug as appropriate to your installed version. For Magento Open Source, upgrade to 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, or 2.4.6-2026-aug. For Adobe Commerce B2B, apply the corresponding patches 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, or 1.3.3-2026-aug. As a compensating control prior to patching, restrict admin panel access (typically /admin) to known trusted IP ranges using web server or WAF rules - note this does not eliminate risk if attacker access originates from a trusted IP. Additionally, audit all high-privilege admin accounts for unauthorized additions or credential exposure, and enable multi-factor authentication on all admin accounts where supported.