CVE-2026-47984

Adobe Commerce | Incorrect Authorization (CWE-863)

View on CVE.org
Published Jul 14, 2026 CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Description
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.

Analysis

AI-generated

Technical impact

Adobe Commerce is affected by an Incorrect Authorization flaw that enables an attacker to bypass security measures and gain unauthorized read and limited write access to protected resources. The vulnerability neglects proper authorization checks, allowing malicious actors to read sensitive data and perform restricted modifications without needing user interaction. This weakness, classified as CWE‑863, effectively undermines the confidentiality and integrity controls of the platform.

Affected Systems

All installations of Adobe Commerce, Adobe Commerce B2B, Adobe Commerce Webhooks Plugin, and Magento Open Source are impacted. Version information is not provided in the advisory, so any version released before an official patch should be considered vulnerable.

Risk and Exploitability

The flaw carries a CVSS score of 8.2, classifying it as high severity, and an EPSS score of less than 1%, indicating that exploitation is currently unlikely. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker can exploit the vulnerability remotely via exposed API endpoints, without requiring user interaction.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the security patch or update released by Adobe as outlined in the Adobe Security Bulletin at https://helpx.adobe.com/security/products/magento/apsb26-73.html.
  • Restrict network exposure of the affected APIs by configuring firewall rules or network segmentation so that only trusted IP addresses or internal networks can access them.
  • Review and enforce least‑priv any unnecessary read or write permissions from users and services.
  • If a patch cannot be applied immediately, temporarily block or restrict unauthenticated or unauthorized access to the vulnerable endpoints using web server configuration.

Generated by OpenCVE AI on August 5, 2026 at 02:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user interaction. Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.
Type Values Removed Values Added
First Time appeared Adobe
Adobe adobe Commerce
Adobe adobe Commerce B2b
Adobe adobe Commerce Webhooks Plugin
Adobe magento Open Source
Vendors & Products Adobe
Adobe adobe Commerce
Adobe adobe Commerce B2b
Adobe adobe Commerce Webhooks Plugin
Adobe magento Open Source
Type Values Removed Values Added
Description Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user interaction.
Title Adobe Commerce | Incorrect Authorization (CWE-863)
Weaknesses CWE-863
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
adobe
Published
Updated
Aug 27, 2026, 10:39 PM
Reserved
May 20, 2026, 3:50 PM

View source JSON

Updated
Jul 15, 2026, 1:53 PM

JSON

Status
Analyzed
Published
Jul 14, 2026, 8:17 PM
Modified
Aug 28, 2026, 12:17 AM

View source JSON

No data.

Updated
Aug 5, 2026, 2:45 AM

JSON