Incorrect authorization in Adobe products - CVE-2026-48415

Vulnerability identifier: #VU141505

CSH Severity: Low

CVSS v4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-48415

CWE-ID: CWE-863

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to bypass security features.

The vulnerability exists due to incorrect authorization in Adobe Commerce B2B when handling requests. A remote user can send crafted requests to bypass security features.

This issue affects the B2B component.

Adobe Commerce B2B
Magento Open Source
Adobe Commerce (formerly Magento Commerce)

Install security update from vendor's website.

Adobe Commerce B2B - addressed in versions 1.3.3-2026-aug, 1.3.4-2026-aug, 1.4.2-2026-aug, 1.5.2-2026-aug, 1.5.3-2026-aug
Magento Open Source - addressed in versions 2.4.6-2026-aug, 2.4.7-2026-aug, 2.4.8-2026-aug, 2.4.9-2026-aug
Adobe Commerce (formerly Magento Commerce) - addressed in versions 2.4.4-2026-aug, 2.4.5-2026-aug, 2.4.6-2026-aug, 2.4.7-2026-aug, 2.4.8-2026-aug, 2.4.9-2026-aug

• https://helpx.adobe.com/security/products/magento/apsb26-92.html

• Multiple vulnerabilities in Adobe Commerce and Magento Open Source