Adobe Commerce contains an Incorrect Authorization vulnerability (CWE-863) identified as CVE-2026-77111. An attacker possessing high privileges can exploit this flaw to bypass security controls, resulting in unauthorized write access. The vulnerability affects the security scope and can lead to limited availability disruption. No user interaction is required for exploitation. The CVSS v3.1 base score is 8.7, indicating high severity with network attack vector, low attack complexity, high privileges required, no user interaction, changed scope, no confidentiality impact, high integrity impact, and high availability impact. No patch or official remediation information is currently available, and no known exploits are reported in the wild.

An attacker with high privileges can bypass security features to gain unauthorized write access, potentially causing limited disruption to system availability. There is no impact on confidentiality. The change in scope indicates that the vulnerability affects resources beyond the original authorization boundaries.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, monitoring Adobe's advisories for updates is recommended. No specific mitigations are provided at this time.