Adobe Commerce, Adobe Commerce B2B, and Magento Open Source are affected by an improper authorization flaw that allows an attacker to bypass security controls, granting unauthorized read and limited write access. The vulnerability does not require any user interaction. Because the scope is changed, once accessed the attacker may obtain privileges that apply system-wide, potentially affecting other protected resources.

The flaw impacts Adobe Commerce Software, Adobe Commerce B2B modules, and Magento Open Source. No specific version numbers are listed in the advisory, so all installed instances of these products should be reviewed for exposure.

The CVSS score of 7.2 indicates a high severity. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting lower public exploitation data. No user interaction is required, implying remote exploitation is possible through web or API interfaces. The change in scope could allow an attacker to extend privileges beyond the initial target.