CVE-2026-92908: Incorrect Authorization (CWE-863) in Adobe Adobe Commerce

CVE-2026-92908 describes an Incorrect Authorization vulnerability in Adobe Commerce. A low-privileged attacker can exploit this flaw to bypass security features, resulting in unauthorized read and write access to the system. This leads to a limited disruption of availability. The vulnerability does not require any user interaction for exploitation. The CVSS 3.1 base score is 8.3, indicating high severity, with attack vector network, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality and integrity, and low impact on availability.

Successful exploitation allows an attacker with low privileges to bypass security mechanisms and gain unauthorized read and write access, potentially compromising confidentiality and integrity of data and causing limited availability disruption. No user interaction is needed, increasing the risk of remote exploitation.

No patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.