Executive brief
Adobe Commerce is an e-commerce platform used by merchants to build and manage online stores. A flaw in access controls allows attackers to bypass security measures and read sensitive data without proper authorization, potentially exposing customer information or business data.
Technical details
This is an incorrect authorization vulnerability (CWE-863) in Adobe Commerce that allows unauthorized read access to protected resources. The vulnerability exists in the access control logic and does not require user interaction or authentication bypass, meaning an attacker can directly access restricted data through a network request. An attacker can leverage this flaw to bypass security features and gain unauthorized read access to sensitive information. Patches have been made available by Adobe.
Affected products
- Adobe Commerce
Timeline
- 2026-08-11: disclosed