EUVD-2026-99213
GHSA-gj43-xw4q-qg25
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
DeliveryCraft request to improperly authorized endpoint
-
ExploitBypass authorization check (CWE-863)
-
ExecutionPerform unauthorized read/write operations
-
ImpactAccess restricted data and cause limited disruption
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a low-privilege authenticated account on the target Adobe Commerce, Adobe Commerce B2B, or Magento Open Source instance (CVSS PR:L) - for example a registered customer or limited back-office/B2B user; no administrative role and no victim user interaction (UI:N) are needed. The affected functionality is network-reachable (AV:N) with low complexity (AC:L), so any internet-facing storefront or admin surface exposing the vulnerable authorization check is in scope. The practical limiting factor is the need for some valid credential: stores that allow open customer or B2B self-registration effectively lower this bar, while deployments restricting account creation raise it. The exact vulnerable feature/endpoint is not named in the description beyond the incorrect-authorization bypass (CWE-863); confirm affected versions and the specific component via Adobe advisory APSB26-153. |
| Impact | This is a credible, above-average priority issue rather than an inflated high-CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable flaw with low attack complexity, no user interaction, and only low-privilege authentication required - a realistic bar for a multi-tenant e-commerce platform where customer, B2B company, or low-tier admin accounts are common and sometimes self-registerable. The CWE-863 Incorrect Authorization classification is consistent with the described security-feature bypass yielding unauthorized read and write (C:H/I:H) with limited availability impact (A:L), which justifies the 8.3 aggregate. However, several escalation signals are ABSENT: no EPSS probability is provided, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced - so there is no evidence of active or at-scale exploitation at this time. The one supplied reference is the Adobe vendor advisory (APSB26-153), meaning affected-version and patch details should be read directly from Adobe rather than inferred here. Net: treat as a prompt-patch item for any internet-facing Adobe Commerce/Magento deployment because of the low privilege requirement and network vector, but note there is no confirmation of exploitation in the wild. |
| Exploit ScenarioDerived | An attacker who holds or registers a low-privilege account (e.g., a customer or limited back-office/B2B user) on an internet-facing Adobe Commerce or Magento Open Source store sends crafted requests to an endpoint whose authorization check is incorrectly enforced. Because no user interaction and only low privileges are needed, the attacker bypasses the intended access control to read and modify data they should not reach, with some limited impact to availability. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Incorrect authorization checks in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allow a low-privileged authenticated user - such as a registered customer or a limited back-office/B2B account - to bypass security controls and gain unauthorized read and write access, with a limited impact on availability (CVSS 8.3, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L). No administrative role and no victim user interaction are required, so any internet-facing storefront or admin surface exposing the vulnerable authorization check is in scope; the practical gating factor is possession of some valid credential, and stores permitting open customer or B2B self-registration lower that bar considerably. At time of analysis there is no CISA KEV listing and no public exploit identified, and no EPSS score was supplied; the root cause is classified as CWE-863 (Incorrect Authorization) and Adobe has published advisory APSB26-153, which should be treated as the authoritative source for affected and fixed versions.
RemediationAI
There is no vendor-released patch version specified in the data available here, so the authoritative first step is to retrieve Adobe advisory APSB26-153 (https://www.adobe.com/trust/security/products/commerce/apsb26-153.html), identify the fixed release for Adobe Commerce, Adobe Commerce B2B, and Magento Open Source respectively, and apply that upgrade - Adobe security bulletins of this class normally list hotfix and cumulative patch identifiers per product and version line, and administrators should also apply any B2B-specific patch noted separately from the core Commerce patch. Until the upgrade is in place, the most effective compensating control is to tighten the credential surface that makes this exploitable: disable or gate open customer and B2B company-account self-registration, and require manual approval of new accounts, accepting that this slows legitimate onboarding; audit and prune ACL roles, web API/GraphQL integration tokens, and B2B company-user permissions to least privilege, which reduces the privileges an attacker can leverage but does not eliminate the underlying bypass; restrict access to admin and B2B endpoints by IP allowlist or VPN, with the trade-off that legitimate remote administrators and partner users lose direct access; and deploy WAF or reverse-proxy rules that monitor and rate-limit authenticated requests performing reads or writes outside expected parameter and object scopes, accepting that such rules are heuristic and may generate false positives against legitimate integrations. Because the correct-authorization defect is in application logic rather than a request-signature pattern, WAF rules alone should be treated as detection and delay rather than a fix, and logging of authenticated read/write activity should be enabled to detect post-exploitation abuse of the bypass.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a server-side authorization defect (CWE-863), meaning the application does authenticate the caller but fails to correctly verify that the caller's role, permission set, or scope permits the requested operation - this is distinct from a missing authentication or missing authorization (CWE-862) issue. In Adobe Commerce and Magento Open Source the relevant surface is the role- and permission-based access control layer (ACL resources, web API/GraphQL role assignments, and B2B company-user hierarchies such as company admin, company user, and shared catalog permissions), where an incorrectly evaluated check can allow a user to invoke endpoints or read/write data outside their granted privileges. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L describes a network-reachable, low-complexity attack that requires only low privileges, needs no user interaction, is scoped to the vulnerable component, and yields high confidentiality and integrity impact with low availability impact - consistent with an attacker reading records they should not see and modifying data they should not be able to change, rather than full system compromise. CPE data identifies three affected code bases: adobe:adobe_commerce, adobe:adobe_commerce_b2b, and adobe:magento_open_source, all recorded with wildcard version ranges, so the precise vulnerable and fixed builds must be confirmed from Adobe advisory APSB26-153. The description does not name the specific endpoint or feature in which the erroneous authorization check resides, so defenders should inventory ACL-protected REST/GraphQL routes and B2B permission boundaries rather than assuming a single known path.
Know when Adobe Commerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Network-reachable storefront flaw exploitable with a low-privilege account (PR:L) and no interaction; incorrect authorization yields high read/write (C:H/I:H) and limited availability impact (A:L).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction.
Executive ViewAI
Adobe Commerce, Adobe Commerce B2B, and Magento Open Source are affected by a high-severity authorization bypass (CVE-2026-92908) that allows any authenticated low-privileged user to gain unauthorized read and write access to sensitive store data. This could lead to exposure or manipulation of customer information, orders, and financial records, undermining customer trust and regulatory compliance. No public exploit identified at time of analysis, but the vulnerability is remotely exploitable without user interaction, and organizations should act to mitigate risk.
Interim mitigations include enforcing least privilege, restricting access to vulnerable endpoints via network controls or additional authentication, deploying WAF rules to detect unauthorized read/write attempts, enabling detailed audit logging, and monitoring for suspicious activity; consider disabling open customer or B2B self-registration to reduce attack surface.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Adobe Commerce
View allServer-side template injection in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows remote unauthentica
Arbitrary code execution in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Adobe Commerce Webhooks Plu
SQL injection in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin allows
Security feature bypass in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks plug
Unauthenticated remote code execution affects Adobe Commerce, Adobe Commerce B2B, and Magento Open Source through improp
Remote, low-complexity code execution is possible in Adobe Commerce, Adobe Commerce B2B and Magento Open Source through
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Inj
Stored cross-site scripting in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows a remote attacker to p
Stored cross-site scripting (XSS) in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows an attacker who
Arbitrary code execution in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plu
Arbitrary code execution is achievable in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source by an attacker who
Stored cross-site scripting in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source lets a low-privileged authent
Exploit-DB