AIKIDO-2026-754501

magento/product-enterprise-edition is vulnerable to Incorrect Authorization

Incorrect AuthorizationCVE-2026-92909 Published 2 days ago

Critical Risk

This Affects:

magento/product-enterprise-edition

0.0.1 - 2.4.4-p18

Fixed in 2.4.4-2026-oct

2.4.5 - 2.4.5-p17

Fixed in 2.4.5-2026-oct

2.4.6 - 2.4.6-p15

Fixed in 2.4.6-2026-oct

2.4.7 - 2.4.7-p10

Fixed in 2.4.7-2026-oct

2.4.8 - 2.4.8-p5

Fixed in 2.4.8-2026-oct

2.4.9 - 2.4.9

Fixed in 2.4.9-2026-oct

Are you affected? Scan for Free

TL;DR

magento/product-enterprise-edition fails to enforce authorization on a network-reachable request path. An unauthenticated attacker can execute code in the application. The fix corrects the authorization checks so unprivileged callers can no longer reach that path.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

magento/product-enterprise-edition is vulnerable to Incorrect Authorization in versions 2.4.9 - 2.4.9, 2.4.8 - 2.4.8-p5, 2.4.7 - 2.4.7-p10, 2.4.6 - 2.4.6-p15, 2.4.5 - 2.4.5-p17 and 0.0.1 - 2.4.4-p18.

How to fix this

Apply the October 2026 Isolated security patch for your release line (for example 2.4.9-2026-oct; see https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-44020). Adobe ships APSB26-153 as Isolated patch files rather than a Composer version bump, so the detected version of the magento/product-enterprise-edition and/or the magento/magento2-ee-base library does not change after the hotfix — ignore this finding manually in Aikido once the Isolated patch is applied.