Adobe Commerce is vulnerable to an Improper Authorization flaw (CWE-285) that allows a user who visits a maliciously crafted URL or interacts with a compromised web page to bypass security controls and obtain unauthorized write privileges. The vulnerability permits the attacker to create or modify data that should be protected, effectively compromising data integrity and confidentiality.

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and any earlier releases are affected. The affected vendor is Adobe.

The CVSS score of 4.3 indicates moderate severity, and the vulnerability is not listed in the CISA KEV catalog. Since the EPSS score is unavailable, the exact likelihood of exploitation is uncertain; however, the requirement for user interaction (clicking a malicious link or visiting a compromised page) limits the attack surface. The flaw is a classic improper authorization problem (CWE-285) that allows attackers to write data they should not be permitted to modify.