Adobe Commerce contains an Incorrect Authorization vulnerability (CWE-863) that enables an attacker to bypass security controls and obtain unauthorized read access. The vulnerability does not require user interaction and affects the security scope, potentially exposing sensitive data. The CVSS 3.1 base score is 8.6, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, and high confidentiality impact. No vendor advisory or patch information is currently available.

Successful exploitation results in unauthorized read access to data, bypassing security features. The confidentiality of information handled by Adobe Commerce can be compromised. Integrity and availability are not impacted according to the CVE description and CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor Adobe's security advisories for updates. No specific mitigations or workarounds are provided at this time.