Adobe Commerce versions before 2.4.9-beta1 contain an Incorrect Authorization flaw that allows an attacker to bypass security controls and obtain write permissions that should be restricted. This weakness can lead to unauthorized code deployment, data modification, or other malicious actions. Because the vulnerability does not require user interaction, an adversary can exploit it remotely by sending specially crafted requests to the application.

The flaw affects Adobe Commerce products, specifically the builds 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and all earlier releases.

The CVSS score of 7.5 indicates a high severity level. With no required user interaction, the attack vector is likely remote via web requests. The EPSS score is not available, but near-zero probability is not ruled out. The vulnerability is not listed in CISA KEV, so no publicly confirmed exploit commands exist yet. Nevertheless, the combination of a high CVSS score and a remote exploitation path makes the risk significant for unpatched installations.