Adobe Commerce versions 2.4.9‑beta1, 2.4.8‑p4, 2.4.7‑p9, 2.4.6‑p14, 2.4.5‑p16, 2.4.4‑p17 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A high‑privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

Adobe Commerce versions 2.4.9‑beta1, 2.4.8‑p4, 2.4.7‑p9, 2.4.6‑p14, 2.4.5‑p16, 2.4.4‑p17 and all earlier releases are affected. The affected product is Adobe Commerce (formerly Magento) provided by Adobe.

The CVSS score indicates low exploitability overall, but the requirement for user interaction reduces the probability that an attacker can gain the necessary context. The EPSS score is < 1%, indicating a very low exploitation probability, and the vulnerability is not listed in CISA KEV, suggesting no known public exploits. However, the scope change to a high‑privileged state means that once an attacker achieves a write operation through a web request, they can execute write operations that normally would have been restricted, exposing the system to potential data tampering or persistence mechanisms.