Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to read select data. Exploitation of this issue does not require user interaction
Severity
Medium 4.3
Published
11 Feb 2025
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
2.4.4
Sources
NVD
Affected software
Software
Affected versions
Magento / Adobe CommerceServers and applications · cpe:a:adobe:commerce
Version 2.4.8-beta1
Version 2.4.7-p3
Version 2.4.7-p2
Version 2.4.7-p1
All 38 release lines
Every version before 2.4.4
Version 2.4.4
Version 2.4.4-p1
Version 2.4.4-p2
Version 2.4.4-p3
Version 2.4.4-p4
Version 2.4.4-p5
Version 2.4.4-p6
Version 2.4.4-p7
Version 2.4.4-p8
Version 2.4.4-p9
Version 2.4.4-p10
Version 2.4.4-p11
Version 2.4.5
Version 2.4.5-p1
Version 2.4.5-p2
Version 2.4.5-p3
Version 2.4.5-p4
Version 2.4.5-p5
Version 2.4.5-p6
Version 2.4.5-p7
Version 2.4.5-p8
Version 2.4.5-p9
Version 2.4.5-p10
Version 2.4.6
Version 2.4.6-p1
Version 2.4.6-p2
Version 2.4.6-p3
Version 2.4.6-p4
Version 2.4.6-p5
Version 2.4.6-p6
Version 2.4.6-p7
Version 2.4.6-p8
Version 2.4.7
Version 2.4.7-p1
Version 2.4.7-p2
Version 2.4.7-p3
Version 2.4.8-beta1
Magento / Adobe CommerceServers and applications · cpe:a:adobe:magento