Adobe Commerce | 不正确的授权 (CWE-863)

Adobe Commerce 的版本 2.4.9-alpha3 及更早版本存在 Incorrect Authorization (CVE-2026-21289) 漏洞。此漏洞允许攻击者绕过安全措施并获得对数据的未经授权的查看访问权限。该漏洞的严重程度在 CVSS 量表上评为 7.5，表明存在重大风险。令人担忧的是，漏洞利用不需要用户交互，从而使其更容易被利用。这可能导致客户敏感信息、交易数据和其他关键业务数据的泄露。使用 Adobe Commerce 的组织应立即采取措施减轻此风险，否则不作为可能导致严重后果。

Organizations running Adobe Commerce, particularly those with custom extensions or integrations, are at risk. Shared hosting environments where multiple tenants share the same Commerce instance are also particularly vulnerable, as a compromise of one tenant could potentially lead to the compromise of others. Legacy configurations with outdated security policies and overly permissive user roles are also at increased risk.

• magento: Check Adobe Commerce logs for unusual access patterns or attempts to access restricted resources.

journalctl -u apache2 -f | grep "access denied"

• magento: Review user roles and permissions to ensure adherence to the principle of least privilege.

# Check user roles
bin/magento user:role:list

• generic web: Monitor access logs for requests to endpoints that should be protected by authorization checks.

curl -I https://your-commerce-site.com/admin/sensitive-data

• generic web: Examine response headers for unexpected status codes (e.g., 200 OK when a 403 Forbidden is expected).

1. 2026-03-11Disclosure

   disclosure

1. 已保留2025-12-12
2. 发布日期2026-03-11
3. EPSS 更新日期2026-03-23

目前，Adobe 尚未为此漏洞提供修复程序（fix）。主要建议是，在发布补丁后立即升级到最新版本的 Adobe Commerce。同时，建议实施额外的安全措施，例如加强访问控制、审查用户权限以及监控系统活动是否存在可疑行为。定期进行安全审计可以帮助识别和解决潜在的漏洞。重要的是，随时了解 Adobe 的安全更新并及时应用补丁。实施 Web Application Firewall (WAF) 也可以提供额外的保护层。