Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Adobe Commerce allows access to other companies' data

CVE-2026-12686 · published 4 months ago
Summary

Adobe Commerce does not properly check user access to company data, which means an authenticated user could see or change sensitive information from other companies hosted on the same website. This could lead to unauthorized access to customer billing data and other sensitive information. To protect your data, update Adobe Commerce to the latest version and ensure you have proper security measures in place.

Original advisory text
An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the same subdomain environment. The appli...
An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the same subdomain environment. The application does not adequately verify whether the requested company ID belongs to the authenticated user’s session, resulting in a cross-tenant authorisation bypass. If this vulnerability is successfully exploited, it allows unauthorised access to sensitive customer information, including billing data, and may enable the unauthorised modification of third-party data.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published6 Jul 2026
Updated4 Nov 2026
First seen6 Jul 2026
Sources
CVE-2026-12686 · NVD
Track software like this
Free during beta