An incorrect authorization flaw allows an attacker to execute code as the current user without requiring user interaction. This vulnerability can lead to arbitrary code execution in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source environments. The weakness is classified as CWE-863, indicating that access control checks are insufficient, enabling unauthorized operations.

Adobe Commerce, Adobe Commerce B2B, and Magento Open Source are impacted. Specific version numbers are not disclosed in the advisory; any instance of these products may be vulnerable until patched.

The severity of the flaw is reflected by a CVSS score of 9.8, which places it in the critical range. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation does not require user interaction and is therefore likely remote; the attacker can trigger the flaw through the exposed administrative interfaces. Given the high impact and the absence of mitigation details from the CNA, organizations should treat this as a critical threat.