Configured Commerce: COM-2026-01 - Broken Access Control

  • Updated

Brief Description:

A high-severity issue concerning broken access control was identified in the Commerce B2B application which allows authenticated user admin console accounts to reach API endpoints for job export, import and integration job cancellation endpoints.

 

Affected Versions:

All versions before 5.2.2606 (STS) and 5.2.2604 (LTS).

 

Solutions and Mitigations:

The application has been updated to prevent user accounts accessing the API endpoint for actions they are not authorized to complete.

 

For Users that Cannot Upgrade:

If you are unable to upgrade, the following mitigations are suggested:

  • Carefully review users of the admin console with the ISC_User role. Any access not required should be removed.

 

CVSS and Severity:

CVSS 7.1, High

 

CVE/CWE ID:

CWE-284