Adobe Commerce contains an Incorrect Authorization vulnerability (CWE-863) that enables a low-privileged attacker to bypass security features, resulting in unauthorized read and write access. The vulnerability can cause limited availability disruption. The CVSS 3.1 score is 7.6, indicating high severity, with an attack vector of network, low attack complexity, requiring low privileges, no user interaction, and impacts confidentiality (low), integrity (high), and availability (low). No patch or official remediation is currently documented, and no known exploits are reported in the wild.

An attacker with low privileges can bypass security mechanisms to gain unauthorized read and write access within Adobe Commerce, potentially leading to data integrity compromise and limited availability disruption. Confidentiality impact is low, but integrity impact is high, and availability impact is low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time.