Improper Authorization Security Feature Bypass in Adobe Commerce and Magento Open Source

Successful exploitation allows an unauthenticated remote attacker to bypass security measures and obtain unauthorized access to protected functionality or data paths. The documented impact is limited confidentiality loss and high integrity impact, indicating the attacker may be able to alter application state, modify protected data, or perform unauthorized actions within the affected commerce environment. Some reporting characterizes the outcome as potentially leading to full control of the affected system, but the more specific vendor impact statement supports security feature bypass and unauthorized access with particularly strong integrity consequences.

No product-specific workaround is described for this vulnerability. If immediate patching is not possible, reduce exposure by restricting access to administrative and other sensitive application interfaces to trusted networks, enforcing strong authentication and least privilege for privileged accounts, and closely monitoring for unauthorized access attempts and integrity-impacting changes. Prioritize rapid deployment of the vendor fixes because exploitation does not require user interaction.

Upgrade to the vendor-fixed releases. For Adobe Commerce, fixed versions include 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, and 2.4.4-p14. For Adobe Commerce B2B, fixed versions include 1.5.3-alpha1, 1.5.2-p1, 1.4.2-p6, 1.3.4-p13, and 1.3.3-p14. For Magento Open Source, fixed versions include 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, and 2.4.5-p13, as applicable to the deployed branch. Apply the relevant product update as soon as possible.