GCVE-110-NCSC-2026-152

Advisory PublishedCVSS 7.5/10

Vulnetix · Advisory published May 13, 2026

Adobe Commerce versions 2.4.9-beta1 and earlier contain an Incorrect Authorization vulnerability that enables attackers to bypass security controls and gain unauthorized write access without user interaction.

Download JSON Open in Console

Weaknesses (CWE)

CWE-863Incorrect AuthorizationCWE-918Server-Side Request Forgery (SSRF)

Risk Scores

CVSS 3.1

7.5/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected Products

Vendor	Product	Versions	Platforms
Adobe	vers:unknown/*	—	—

Aliases

CVE-2026-34645 CVE-2026-34646 CVE-2026-34647 CVE-2026-34648 CVE-2026-34649 CVE-2026-34650

References

advisory

Browse GCVE Records

74,267 records in the GCVE database · Updated July 22, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON