CVE-2026-77111: Adobe Commerce | Incorrect Authorization (CWE-863)
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to bypass security measures and gain unauthorized write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction. Scope is changed.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must already have high privileges in Adobe Commerce. Exploitation does not require user interaction.
What could successful exploitation allow?
An attacker could bypass security measures and obtain unauthorized write access. The reported impact includes a limited disruption to availability.
Is this vulnerability remotely exploitable?
The attack vector is network-based, so exploitation can be performed over the network by an attacker who has the required high privileges.