The identified weakness is an input validation issue that allows a low‑privileged attacker to bypass a security control, granting access to data they are not authorized to read. The flaw does not require victim interaction and may be activated by specially crafted requests to the affected application. The vulnerability directly compromises confidentiality by enabling unauthorized data exposure.

Adobe Commerce, including the Adobe Commerce B2B and Magento Open Source variants, are impacted by this issue. Specific versions are not listed in the provided data, so any deployment of these products that has not been patched may be vulnerable.

The CVSS score of 4.3 places the vulnerability in the medium range, and the EPSS score is unavailable for this analysis. The issue is not currently listed in CISA’s KEV catalog, suggesting no widespread exploitation has been reported. However, the lack of user interaction and the ability to read restricted data indicate a meaningful risk if the flaw remains unaddressed. The most likely attack vector is through endpoint requests that do not undergo proper input sanitization.