CVE-2026-48412Low· 2.7▾ SunlitAdobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to restricted resources. Exploita…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 14.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.5%
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to restricted resources. Exploitation of this issue does not require user interaction.
commerce = 2.4.4commerce = 2.4.5commerce = 2.4.6commerce = 2.4.7commerce = 2.4.8commerce = 2.4.9magento = 2.4.6magento = 2.4.7magento = 2.4.8magento = 2.4.9commerce_b2b = 1.3.3commerce_b2b = 1.3.4commerce_b2b = 1.3.5commerce_b2b = 1.4.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-48415High· 7.6Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass
CVE-2026-48411Medium· 6.5Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass
CVE-2026-71362Critical· 9.1Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation
CVE-2026-48413High· 8.7Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields
CVE-2026-48414High· 7.7Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields
CVE-2026-77108High· 7.5Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation