Adobe Commerce versions 2.4.9‑alpha3, 2.4.8‑p3, 2.4.7‑p8, 2.4.6‑p13, 2.4.5‑p15, 2.4.4‑p16 and earlier are affected by an Incorrect Authorization vulnerability (CWE‑863). The flaw allows an attacker to bypass a software‑defined security feature without user interaction, potentially creating a privilege escalation path. The impact is limited to integrity and availability of data due to the security deception, but the ability to circumvent access controls poses a significant risk to business operations.

Affected vendors include Adobe: Adobe Commerce, with affected release lines up through 2.4.9‑alpha3 and earlier. The vulnerability also applies to the Magento open source platform for the same version ranges referenced in the CPE data.

The CVSS v3 score of 4.7 denotes a medium severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, suggesting a lower priority for exploit discovery. Attackers would need to target the exposed web or API endpoints, but the exploit does not require user interaction and depends on environmental conditions that may be outside the attacker’s control.