CVE-2026-92910: Incorrect Authorization (CWE-863) in Adobe Adobe Commerce

CVE-2026-92910 is an Incorrect Authorization vulnerability in Adobe Commerce that enables an attacker to bypass security controls, resulting in unauthorized read and limited write access. The vulnerability does not require any user interaction and affects the security scope of the application. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, changed scope, and impacts on confidentiality and integrity but not availability.

An attacker exploiting this vulnerability can bypass security features to gain unauthorized read access and limited write access to Adobe Commerce data. This could lead to exposure of sensitive information and unauthorized modifications within the affected system. The scope change indicates that the vulnerability affects resources beyond the initially intended security boundaries.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, monitor Adobe's advisories for updates and apply any recommended temporary mitigations if provided.