Adobe Commerce contains an Incorrect Authorization vulnerability (CWE-863) that could be exploited by an attacker to bypass security controls, resulting in unauthorized read access and limited write access to the system. The vulnerability does not require any user interaction to be exploited. The CVSS v3.1 base score is 8.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could lead to unauthorized disclosure of sensitive information (high confidentiality impact) and limited unauthorized modification of data (low integrity impact). There is no impact on system availability. The vulnerability allows attackers to bypass security features, potentially compromising the security posture of affected Adobe Commerce installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround has been published, monitoring Adobe's security advisories for updates is recommended. No specific mitigation steps can be provided at this time.