Read the docs
TI-2026-71928 Aliases CVE-2026-92908GHSA-gj43-xw4q-qg25

Incorrect authorization in Adobe Commerce allows security bypass

Priority LOW 39CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Adobe Commerce, Adobe Commerce B2B and Magento Open Source contain an incorrect authorization flaw (CWE-863) that can cause a security feature bypass. A low-privileged remote attacker can bypass security measures without user interaction to gain unauthorized read and write access, with a limited impact on availability. Affected releases are listed as through 2.4.9-2026-sep for Adobe Commerce and Magento Open Source and through 1.5.3-2026-sep for Adobe Commerce B2B, across several branches.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.006 48th percentileScored 2026-11-07
Fix Fixed Adobe Commerce (Adobe): 2.4.10-alpha1,2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct +3Adobe Commerce B2B (Adobe): 1.5.4-alpha1,1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct +2+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AdobeAdobe Commerceup to 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep2.4.10-alpha1,2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct, 2.4.4-2026-octPatch availableCNA
AdobeAdobe Commerce B2Bup to 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep1.5.4-alpha1,1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct, 1.3.3-2026-octPatch availableCNA
AdobeMagento Open Sourceup to 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep2.4.10-alpha1,2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-octPatch availableCNA
  • Adobe Commerce VendorAdobe Affected up to 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep Fixed in 2.4.10-alpha1,2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct, 2.4.4-2026-oct Patch available CNA
  • Adobe Commerce B2B VendorAdobe Affected up to 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep Fixed in 1.5.4-alpha1,1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct, 1.3.3-2026-oct Patch available CNA
  • Magento Open Source VendorAdobe Affected up to 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep Fixed in 2.4.10-alpha1,2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct Patch available CNA

Remediation

Upgrade Adobe Commerce to 2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct or 2.4.4-2026-oct. Upgrade Adobe Commerce B2B to 1.5.4-alpha1, 1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct or 1.3.3-2026-oct. Upgrade Magento Open Source to 2.4.10-alpha1, 2.4.9-2026-oct, 2.4.8-2026-oct or 2.4.7-2026-oct.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

  • Fix · CNA Adobe Commerce (Adobe) Fixed in 2.4.10-alpha1,2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct, 2.4.4-2026-oct
  • Fix · CNA Adobe Commerce B2B (Adobe) Fixed in 1.5.4-alpha1,1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct, 1.3.3-2026-oct
  • Fix · CNA Magento Open Source (Adobe) Fixed in 2.4.10-alpha1,2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Adobe Commerce, Adobe Commerce B2B, Magento Open Source — adobe.com/trust/security/products/commerce/apsb26-153.html

    11 records Highest priority Priority HIGH 1 HIGH, 6 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2026-71941 Template engine injection in Adobe Commerce allows code executionPriority HIGH 82
    • TI-2026-71929 Incorrect authorization in Adobe Commerce allows code executionPriority MEDIUM 50
    • TI-2026-71938 Stored cross-site scripting in Adobe Commerce form fieldsPriority MEDIUM 44
    Show all 11 records → Advisory →

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-92908
  2. 2026-10-13 CISA SSVC decision points changed
  3. 2026-10-13 Priority changed: MEDIUM → LOW
  4. 2026-10-13 Alias added: GHSA-gj43-xw4q-qg25
  5. 2026-10-15 CISA SSVC decision points changed

References

Advisory 1

  • TI-2026-52938 Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-35688 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-34084 Adobe Experience Manager | Incorrect Authorization (CWE-863) KEVCVSS 3.1CRITICAL 10.0
  • TI-2024-22559 XXE can expose crypt key and other secrets granting full admin access KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-19615 Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-13696 Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution KEVCVSS 3.1CRITICAL 9.8
See all 8046 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences