Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier contain an Incorrect Authorization flaw (CWE-863). The flaw allows an attacker to bypass security controls and gain limited unauthorized view access to data. The vulnerability can be exploited without user interaction, which means that a remote attacker could trigger the bypass by sending specially crafted requests to the vulnerable system.

Affected products: Adobe Commerce (Magento). Specific vulnerable versions include 2.4.4-p16 and all earlier releases, 2.4.5-p15, 2.4.6-p13, 2.4.7-p8, 2.4.8-p3, and 2.4.9-alpha3. All other Adobe Commerce releases not listed are considered not vulnerable.

The CVSS score is 5.3, indicating a moderate severity. EPSS shows exploitation probability is less than 1%, and the vulnerability is not listed in KEV. Because exploitation does not require user interaction, the attack vector can be remote, potentially allowing an attacker to trigger the bypass by sending crafted requests to exposed endpoints. The risk is moderate but requires timely remediation to protect sensitive data.