CVE-2026-92910
Adobe Commerce | Incorrect Authorization (CWE-863)
At a glance Severity HIGH 7.2 EPSS EPSS 0.41 % · percentile 35 (2026-10-27) State PUBLISHED Published 2026-10-13 Updated 2026-10-14 Assigner adobe NVD status Awaiting Analysis Description Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction. Scope is changed.
Scores Version Score Vector Scored by CVSS 3.1 HIGH 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N adobe CVSS 3.1 HIGH 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N NVD · psirt@adobe.com (Secondary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected products Product Versions Adobe · Adobe Commerce affected 0 ≤ 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep ; unaffected 2.4.10-alpha1,2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct, 2.4.4-2026-oct Adobe · Adobe Commerce B2B affected 0 ≤ 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep ; unaffected 1.5.4-alpha1,1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct, 1.3.3-2026-oct Adobe · Magento Open Source affected 0 ≤ 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep ; unaffected 2.4.10-alpha1,2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct
References
Sources
