CVE-2026-92908
Adobe Commerce | Incorrect Authorization (CWE-863)
En bref Sévérité HIGH 8.3 EPSS EPSS 0.60 % · centile 49 (2026-10-27) État PUBLISHED Publiée 2026-10-13 Mise à jour 2026-10-15 Attribuée par adobe Statut NVD Awaiting Analysis Description Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction.
Scores Version Score Vecteur Évalué par CVSS 3.1 HIGH 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L adobe CVSS 3.1 HIGH 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L NVD · psirt@adobe.com (Secondary)
Faiblesses (CWE)
Références européennes
Avis du CERT-FR
Produits affectés Produit Versions Adobe · Adobe Commerce affected 0 ≤ 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep ; unaffected 2.4.10-alpha1,2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct, 2.4.4-2026-oct Adobe · Adobe Commerce B2B affected 0 ≤ 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep ; unaffected 1.5.4-alpha1,1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct, 1.3.3-2026-oct Adobe · Magento Open Source affected 0 ≤ 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep ; unaffected 2.4.10-alpha1,2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct
Références
Sources
