CVE-2026-48415 is a high severity (CVSS 7.6) incorrect authorization flaw in Adobe Commerce, Commerce B2B and Magento Open Source. A low-privileged attacker can bypass a security feature and gain unauthorized read and write access. Adobe fixed it in the 2026-aug update, bulletin APSB26-92.
What's affected
Adobe's bulletin APSB26-92 lists these products as affected at the July 2026 security update level and earlier:
- Adobe Commerce 2.4.4 to 2.4.9, each at the 2026-jul release and earlier.
- Adobe Commerce B2B 1.3.3, 1.3.4, 1.4.2, 1.5.2 and 1.5.3, each at the 2026-jul release and earlier.
- Magento Open Source 2.4.6 to 2.4.9, each at the 2026-jul release and earlier.
The updated versions carry the 2026-aug suffix, for example 2.4.8-2026-aug. Adobe says it is not aware of any exploits in the wild for the issues addressed in this bulletin, and it rates the update priority 2.
Severity labels differ. The record scores it 7.6 (CVSS 3.1, High). Adobe's bulletin gives the same 7.6 score but labels it Critical on its own scale. This article uses High, matching the score band.
How to check if you're exposed
On the server, from the Magento root:
bin/magento --version
composer show magento/product-community-edition | grep versions
For Adobe Commerce the package name is magento/product-enterprise-edition. Compare the result with the 2026-aug versions in the bulletin. Adobe Commerce on cloud infrastructure may receive updates through its own process, so confirm with your platform team.
What to do now
- Apply the 2026-aug security update for your version line, as listed in APSB26-92.
- Read the release notes for the August 2026 security update before you deploy, and test on staging.
- Review admin and API accounts and remove permissions that are not needed.
- The bulletin covers other CVEs too, so use the one update for all of them.
Why it matters
The record lists CWE-863, incorrect authorization. A security measure that should stop a low-privileged account from reading or writing data does not hold, and no user interaction is needed. The impact is high on integrity with limited effects on confidentiality and availability.
In a store, that can mean data a low-privileged account should never touch. Role design and API token scope are worth reviewing alongside the patch. The record does not mark this CVE as known exploited, and Adobe says it is not aware of any exploits in the wild for these issues.
Quick check
Does the attacker need to be an admin?
No. The description says a low-privileged attacker can use it, and no user interaction is required.
Which update fixes it?
The 2026-aug security update for your version line, listed in Adobe bulletin APSB26-92.
Sources
Last reviewed: 18 October 2026.
