UpHeron
All vulnerabilities

Servers and applications

CVE-2026-21297

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized access to a feature. Exploitation of this issue does not require user…

Severity
Medium 4.3
Published
11 Mar 2026
Last changed
28 Aug 2026
Added to UpHeron
21 Oct 2026
Fixed in
2.4.4, 2.4.5
Sources
NVD

Affected software

SoftwareAffected versions
Magento / Adobe CommerceServers and applications · cpe:a:adobe:commerce
  • Version 2.4.9-alpha3
  • Version 2.4.9-alpha2
  • Version 2.4.9-alpha1
  • Version 2.4.8-p3
All 69 release lines
  • Every version before 2.4.4
  • Version 2.4.4
  • Version 2.4.4-p1
  • Version 2.4.4-p2
  • Version 2.4.4-p3
  • Version 2.4.4-p4
  • Version 2.4.4-p5
  • Version 2.4.4-p6
  • Version 2.4.4-p7
  • Version 2.4.4-p8
  • Version 2.4.4-p9
  • Version 2.4.4-p10
  • Version 2.4.4-p11
  • Version 2.4.4-p12
  • Version 2.4.4-p13
  • Version 2.4.4-p14
  • Version 2.4.4-p15
  • Version 2.4.4-p16
  • Version 2.4.5
  • Version 2.4.5-p1
  • Version 2.4.5-p2
  • Version 2.4.5-p3
  • Version 2.4.5-p4
  • Version 2.4.5-p5
  • Version 2.4.5-p6
  • Version 2.4.5-p7
  • Version 2.4.5-p8
  • Version 2.4.5-p9
  • Version 2.4.5-p10
  • Version 2.4.5-p11
  • Version 2.4.5-p12
  • Version 2.4.5-p13
  • Version 2.4.5-p14
  • Version 2.4.5-p15
  • Version 2.4.6
  • Version 2.4.6-p1
  • Version 2.4.6-p2
  • Version 2.4.6-p3
  • Version 2.4.6-p4
  • Version 2.4.6-p5
  • Version 2.4.6-p6
  • Version 2.4.6-p7
  • Version 2.4.6-p8
  • Version 2.4.6-p9
  • Version 2.4.6-p10
  • Version 2.4.6-p11
  • Version 2.4.6-p12
  • Version 2.4.6-p13
  • Version 2.4.7-b1
  • Version 2.4.7-b2
  • Version 2.4.7-beta3
  • Version 2.4.7
  • Version 2.4.7-p1
  • Version 2.4.7-p2
  • Version 2.4.7-p3
  • Version 2.4.7-p4
  • Version 2.4.7-p5
  • Version 2.4.7-p6
  • Version 2.4.7-p7
  • Version 2.4.7-p8
  • Version 2.4.8-beta1
  • Version 2.4.8-beta2
  • Version 2.4.8
  • Version 2.4.8-p1
  • Version 2.4.8-p2
  • Version 2.4.8-p3
  • Version 2.4.9-alpha1
  • Version 2.4.9-alpha2
  • Version 2.4.9-alpha3
Magento / Adobe CommerceServers and applications · cpe:a:adobe:magento
  • Version 2.4.9-alpha3
  • Version 2.4.8-p3
  • Version 2.4.8-p2
  • Version 2.4.8-p1
All 50 release lines
  • Every version before 2.4.5
  • Version 2.4.5
  • Version 2.4.5-p1
  • Version 2.4.5-p2
  • Version 2.4.5-p3
  • Version 2.4.5-p4
  • Version 2.4.5-p5
  • Version 2.4.5-p6
  • Version 2.4.5-p7
  • Version 2.4.5-p8
  • Version 2.4.5-p9
  • Version 2.4.5-p10
  • Version 2.4.5-p11
  • Version 2.4.5-p12
  • Version 2.4.5-p13
  • Version 2.4.5-p14
  • Version 2.4.5-p15
  • Version 2.4.6
  • Version 2.4.6-p1
  • Version 2.4.6-p2
  • Version 2.4.6-p3
  • Version 2.4.6-p4
  • Version 2.4.6-p5
  • Version 2.4.6-p6
  • Version 2.4.6-p7
  • Version 2.4.6-p8
  • Version 2.4.6-p9
  • Version 2.4.6-p10
  • Version 2.4.6-p11
  • Version 2.4.6-p12
  • Version 2.4.6-p13
  • Version 2.4.7-b1
  • Version 2.4.7-b2
  • Version 2.4.7-beta3
  • Version 2.4.7
  • Version 2.4.7-p1
  • Version 2.4.7-p2
  • Version 2.4.7-p3
  • Version 2.4.7-p4
  • Version 2.4.7-p5
  • Version 2.4.7-p6
  • Version 2.4.7-p7
  • Version 2.4.7-p8
  • Version 2.4.8-beta1
  • Version 2.4.8-beta2
  • Version 2.4.8
  • Version 2.4.8-p1
  • Version 2.4.8-p2
  • Version 2.4.8-p3
  • Version 2.4.9-alpha3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-21297
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-21297