CVE-2026-48412
What it is
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to restricted resources. Exploitation of this issue does not require user interaction.
At a glance
- Exploitability
- Can be exploited over the network with an admin-level account. Limited direct impact.
- Exploit odds
- 0.6% chance of exploitation in the next 30 days (EPSS).
- Fix
- A patch, advisory or fixed version is referenced. Upgrade or apply it.
Timeline
- PublishedDisclosed publicly on CVE.org and NVD
- Last updatedMost recent change to the record
Details
- Published
- Last modified
- Exploit probability
- 0.6% · EPSS, next 30 days
- Weakness
- CWE-863 · Incorrect authorization
- Record status
- Analyzed
Affected
- Adobe Commerce 2.4.4
- Adobe Commerce 2.4.5
- Adobe Commerce 2.4.6
- Adobe Commerce 2.4.7
- Adobe Commerce 2.4.8
- Adobe Commerce 2.4.9
- Adobe Magento 2.4.6
- Adobe Magento 2.4.7
Attack profile CVSS 3.1 · 2.7
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
