CVE-2026-21296
Received
Received - Intake
Incorrect Authorization in Adobe Commerce Allows Unauthorized Data Access
Publication date: 2026-03-11
Last updated on: 2026-03-11
Assigner: Adobe Systems Incorporated
Description
Description
Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized view access of data. Exploitation of this issue does not require user interaction.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| adobe | commerce | 2.4.4 |
| adobe | commerce | 2.4.5 |
| adobe | commerce | 2.4.4 |
| adobe | commerce | to 2.4.4 (exc) |
| adobe | commerce | 2.4.5 |
| adobe | commerce | 2.4.4 |
| adobe | commerce | 2.4.5 |
| adobe | commerce | 2.4.4 |
| adobe | commerce | 2.4.6 |
| adobe | commerce | 2.4.4 |
| adobe | commerce | 2.4.5 |
| adobe | commerce | 2.4.6 |
| adobe | commerce | 2.4.5 |
| adobe | commerce | 2.4.4 |
| adobe | commerce | 2.4.7 |
| adobe | commerce | 2.4.5 |
| adobe | commerce | 2.4.6 |
| adobe | commerce | 2.4.6 |
| adobe | commerce | 2.4.4 |
| adobe | commerce | 2.4.4 |
| adobe | commerce | 2.4.4 |
| adobe | commerce | 2.4.4 |
| adobe | commerce | 2.4.7 |
| adobe | commerce | 2.4.7 |
| adobe | commerce | 2.4.7 |
| adobe | commerce | 2.4.6 |
| adobe | commerce | 2.4.6 |
| adobe | commerce | 2.4.6 |
| adobe | commerce | 2.4.5 |
| adobe | commerce | 2.4.5 |
| adobe | commerce | 2.4.5 |
| adobe | commerce | 2.4.7 |
| adobe | commerce | 2.4.4 |
| adobe | commerce | 2.4.5 |
| adobe | commerce | 2.4.6 |
| adobe | commerce | 2.4.7 |
| adobe | commerce | 2.4.4 |
| adobe | commerce | 2.4.8 |
| adobe | commerce | 2.4.7 |
| adobe | commerce | 2.4.6 |
| adobe | commerce | 2.4.5 |
| adobe | commerce | 2.4.4 |
| adobe | commerce | 2.4.5 |
| adobe | commerce | 2.4.6 |
| adobe | commerce | 2.4.7 |
| adobe | commerce | 2.4.8 |
| adobe | commerce | 2.4.7 |
| adobe | commerce | 2.4.8 |
| adobe | commerce | 2.4.4 |
| adobe | commerce | 2.4.5 |
| adobe | commerce | 2.4.6 |
| adobe | commerce | 2.4.4 |
| adobe | commerce | 2.4.5 |
| adobe | commerce | 2.4.6 |
| adobe | commerce | 2.4.7 |
| adobe | commerce | 2.4.8 |
| adobe | commerce | 2.4.9 |
| adobe | commerce | 2.4.4 |
| adobe | commerce | 2.4.5 |
| adobe | commerce | 2.4.6 |
| adobe | commerce | 2.4.7 |
| adobe | commerce | 2.4.8 |
| adobe | commerce | 2.4.9 |
| adobe | commerce | 2.4.4 |
| adobe | commerce | 2.4.5 |
| adobe | commerce | 2.4.6 |
| adobe | commerce | 2.4.7 |
| adobe | commerce | 2.4.8 |
| adobe | commerce | 2.4.9 |
| adobe | commerce_b2b | 1.4.2 |
| adobe | commerce_b2b | 1.4.2 |
| adobe | commerce_b2b | 1.4.2 |
| adobe | commerce_b2b | 1.3.5 |
| adobe | commerce_b2b | 1.3.4 |
| adobe | commerce_b2b | 1.3.4 |
| adobe | commerce_b2b | 1.3.5 |
| adobe | commerce_b2b | 1.3.3 |
| adobe | commerce_b2b | 1.3.3 |
| adobe | commerce_b2b | 1.4.2 |
| adobe | commerce_b2b | 1.3.5 |
| adobe | commerce_b2b | 1.3.4 |
| adobe | commerce_b2b | 1.3.3 |
| adobe | commerce_b2b | to 1.3.3 (exc) |
| adobe | commerce_b2b | 1.3.3 |
| adobe | commerce_b2b | 1.3.3 |
| adobe | commerce_b2b | 1.3.3 |
| adobe | commerce_b2b | 1.3.3 |
| adobe | commerce_b2b | 1.3.3 |
| adobe | commerce_b2b | 1.3.3 |
| adobe | commerce_b2b | 1.3.3 |
| adobe | commerce_b2b | 1.3.3 |
| adobe | commerce_b2b | 1.3.3 |
| adobe | commerce_b2b | 1.3.3 |
| adobe | commerce_b2b | 1.3.4 |
| adobe | commerce_b2b | 1.3.4 |
| adobe | commerce_b2b | 1.3.4 |
| adobe | commerce_b2b | 1.3.4 |
| adobe | commerce_b2b | 1.3.4 |
| adobe | commerce_b2b | 1.3.4 |
| adobe | commerce_b2b | 1.3.4 |
| adobe | commerce_b2b | 1.3.4 |
| adobe | commerce_b2b | 1.3.4 |
| adobe | commerce_b2b | 1.3.5 |
| adobe | commerce_b2b | 1.4.2 |
| adobe | commerce_b2b | 1.3.3 |
| adobe | commerce_b2b | 1.3.4 |
| adobe | commerce_b2b | 1.3.5 |
| adobe | commerce_b2b | 1.4.2 |
| adobe | commerce_b2b | 1.5.2 |
| adobe | commerce_b2b | 1.3.5 |
| adobe | commerce_b2b | 1.3.5 |
| adobe | commerce_b2b | 1.3.5 |
| adobe | commerce_b2b | 1.3.5 |
| adobe | commerce_b2b | 1.3.5 |
| adobe | commerce_b2b | 1.3.5 |
| adobe | commerce_b2b | 1.3.3 |
| adobe | commerce_b2b | 1.3.4 |
| adobe | commerce_b2b | 1.3.5 |
| adobe | commerce_b2b | 1.4.2 |
| adobe | commerce_b2b | 1.5.2 |
| adobe | commerce_b2b | 1.5.3 |
| adobe | commerce_b2b | 1.3.3 |
| adobe | commerce_b2b | 1.3.4 |
| adobe | commerce_b2b | 1.4.2 |
| adobe | commerce_b2b | 1.5.2 |
| adobe | commerce_b2b | 1.5.3 |
| adobe | commerce_b2b | 1.3.5 |
| adobe | commerce_b2b | 1.3.3 |
| adobe | commerce_b2b | 1.3.4 |
| adobe | commerce_b2b | 1.3.5 |
| adobe | commerce_b2b | 1.4.2 |
| adobe | commerce_b2b | 1.5.2 |
| adobe | commerce_b2b | 1.5.3 |
| adobe | magento | 2.4.5 |
| adobe | magento | 2.4.5 |
| adobe | magento | 2.4.5 |
| adobe | magento | 2.4.6 |
| adobe | magento | 2.4.6 |
| adobe | magento | 2.4.6 |
| adobe | magento | 2.4.7 |
| adobe | magento | 2.4.5 |
| adobe | magento | 2.4.5 |
| adobe | magento | 2.4.6 |
| adobe | magento | 2.4.6 |
| adobe | magento | 2.4.5 |
| adobe | magento | 2.4.5 |
| adobe | magento | 2.4.5 |
| adobe | magento | 2.4.6 |
| adobe | magento | 2.4.7 |
| adobe | magento | 2.4.7 |
| adobe | magento | 2.4.7 |
| adobe | magento | 2.4.6 |
| adobe | magento | 2.4.5 |
| adobe | magento | 2.4.7 |
| adobe | magento | 2.4.5 |
| adobe | magento | 2.4.6 |
| adobe | magento | 2.4.7 |
| adobe | magento | 2.4.8 |
| adobe | magento | 2.4.7 |
| adobe | magento | 2.4.6 |
| adobe | magento | 2.4.5 |
| adobe | magento | 2.4.5 |
| adobe | magento | 2.4.6 |
| adobe | magento | 2.4.7 |
| adobe | magento | 2.4.8 |
| adobe | magento | 2.4.5 |
| adobe | magento | 2.4.6 |
| adobe | magento | 2.4.7 |
| adobe | magento | 2.4.8 |
| adobe | magento | to 2.4.5 (exc) |
| adobe | magento | 2.4.5 |
| adobe | magento | 2.4.6 |
| adobe | magento | 2.4.7 |
| adobe | magento | 2.4.8 |
| adobe | magento | 2.4.5 |
| adobe | magento | 2.4.6 |
| adobe | magento | 2.4.7 |
| adobe | magento | 2.4.8 |
| adobe | magento | 2.4.5 |
| adobe | magento | 2.4.6 |
| adobe | magento | 2.4.7 |
| adobe | magento | 2.4.8 |
| adobe | magento | 2.4.9 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects certain versions of Adobe Commerce and is classified as an Incorrect Authorization issue. It allows a low-privileged attacker to bypass security features and gain limited unauthorized view access to data without requiring any user interaction.
How can this vulnerability impact me? :
The impact of this vulnerability is that an attacker with low privileges could bypass security controls and view data they are not authorized to access. Although the access is limited and does not allow modification or disruption, unauthorized data exposure could still pose a risk.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know
Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70