The CVE describes an Incorrect Authorization flaw in Adobe Commerce and related products. The flaw permits a low‑privileged attacker to bypass security checks and obtain unauthorized read and write privileges. This could allow the attacker to access or modify protected data and cause a limited disruption of system availability. The weakness is mapped to CWE‑863, indicating that improper enforcement of access control is the root cause.

Affected vendors include Adobe, with products Adobe Commerce, Adobe Commerce B2B and the Magento Open Source edition. No specific version details are provided by the CNA, so all installations of these products that have not applied the vendor’s update may be vulnerable.

The CVSS score of 8.3 indicates a high‑severity vulnerability, and the EPSS score is currently unavailable. The issue does not require user interaction, meaning it can be exploited remotely by an attacker who already possesses a low‑privileged account. The vulnerability is not listed in the CISA KEV catalog, but its high severity and remote nature make it important to address promptly.