Incorrect Authorization Security Feature Bypass in Adobe Commerce B2B

Successful exploitation allows a low-privileged attacker to bypass intended authorization controls and carry out unauthorized actions. The stated impact is high confidentiality impact and low integrity impact, with no availability impact specified. In practice, this means an attacker may gain access to restricted information or protected functionality that should be unavailable to their privilege level, while also being able to make limited unauthorized changes.

If immediate patching is not possible, reduce exposure by restricting access to Adobe Commerce administrative and privileged B2B functionality to only trusted users and networks, reviewing role assignments for least privilege, and monitoring for anomalous use of B2B features by low-privileged accounts. Because exploitation requires valid low-privileged access but no user interaction, temporary mitigation should focus on minimizing account exposure, tightening authorization boundaries operationally, and increasing audit review until patched versions can be deployed.

Upgrade Adobe Commerce and the affected B2B edition components to the vendor-fixed releases. The available fixed versions indicate Adobe Commerce 2.4.8 should be updated to 2.4.8-beta2 or later, 2.4.7 to 2.4.7-p4 or later, 2.4.6 to 2.4.6-p9 or later, 2.4.5 to 2.4.5-p11 or later, and 2.4.4 to 2.4.4-p12 or later. For Adobe Commerce B2B, update 1.4.2 to 1.4.2-p4 or later, 1.3.5 to 1.3.5-p9 or later, 1.3.4 to 1.3.4-p11 or later, and 1.3.3 to 1.3.3-p12 or later.