CVE-2026-48412 is a low severity (CVSS 2.7) incorrect authorization flaw in Adobe Commerce, Commerce B2B and Magento Open Source. An attacker with high privileges could gain access to restricted resources. Adobe fixed it in the 2026-aug update, bulletin APSB26-92. The steps below show how to check your version and what to change.
What's affected
Adobe's bulletin APSB26-92 lists these products as affected at the July 2026 security update level and earlier:
- Adobe Commerce 2.4.4 to 2.4.9, each at the 2026-jul release and earlier.
- Adobe Commerce B2B 1.3.3, 1.3.4, 1.4.2, 1.5.2 and 1.5.3, each at the 2026-jul release and earlier.
- Magento Open Source 2.4.6 to 2.4.9, each at the 2026-jul release and earlier.
The updated versions carry the 2026-aug suffix, for example 2.4.8-2026-aug. Adobe says it is not aware of any exploits in the wild for the issues addressed in this bulletin, and it rates the update priority 2.
Severity labels differ. The record scores it 2.7 (CVSS 3.1, Low). Adobe's bulletin gives the same 2.7 score and vector, but labels the severity Moderate, which is Adobe's own rating scale. Treat 2.7 as the number to compare.
How to check if you're exposed
On the server, from the Magento root:
bin/magento --version
composer show magento/product-community-edition | grep versions
For Adobe Commerce the package name is magento/product-enterprise-edition. Compare the result with the 2026-aug versions in the bulletin. Adobe Commerce on cloud infrastructure may receive updates through its own process, so confirm with your platform team.
What to do now
- Apply the 2026-aug security update for your version line, as listed in APSB26-92.
- Read the release notes for the August 2026 security update before you deploy, and test on staging.
- Review admin and API accounts and remove permissions that are not needed.
- The bulletin covers other CVEs too, so use the one update for all of them.
Why it matters
The record lists CWE-863, incorrect authorization. A check that should limit what an administrator can reach does not. The attack requires high privileges, meaning an administrator account, and has limited impact on integrity. That is why the score is low.
Low scores can still matter in shops with many administrators, agencies or contractors holding accounts. Privilege boundaries between admin roles are a real control in those setups. The record does not mark this CVE as known exploited, and Adobe says it knows of no exploits for the bulletin's issues.
Quick check
Why is this rated low when it is a privilege escalation?
It needs an attacker who already has high privileges and the impact is limited, which keeps the CVSS score at 2.7.
Is there a workaround?
The bulletin points to the security update. Apply it for your version line.
Sources
Last reviewed: 18 October 2026.
