Incorrect Authorization Vulnerability in Adobe Commerce
CVE-2026-48411

6.5MEDIUM

Key Information:

Vendor

Adobe
Status
Adobe Commerce
Adobe Commerce B2b
Magento Open Source
Vendor
CVE Published:
11 August 2026

What is CVE-2026-48411?

Adobe Commerce has been found to exhibit an Incorrect Authorization vulnerability that may lead to a bypass of critical security measures. Attackers with elevated privileges could exploit this weakness to gain unauthorized write access to sensitive areas within the product. Notably, this vulnerability can be targeted without requiring any interaction from users, elevating the risk and urgency for organizations utilizing Adobe Commerce to implement necessary security patches and updates.

Affected Version(s)

Adobe Commerce 0 <= 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug

Adobe Commerce 0 <= 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug

Adobe Commerce B2B 0 <= 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul

References

https://helpx.adobe.com/security/products/magento/apsb26-...
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.