Configured Commerce: COM-2026-01 - Broken Access Control

Updated September 16, 2026 20:51

Brief Description:

A high-severity issue concerning broken access control was identified in the Commerce B2B application which allows a storefront user to send requests to specific admin center API endpoints which were not previously validated for authorization.

Affected Versions:

All versions before 5.2.2604.956+lts and 5.2.2608.656+sts

Solutions and Mitigations:

The application has been updated to remediate the API endpoints that were not evaluating authorization properly.

CVSS and Severity:

CVSS 8.8, High

CVE/CWE ID:

CWE-269

Should you have any questions or need further information, please do not hesitate to contact our support team at support@optimizely.com.

Configured Commerce: COM-2026-01 - Broken Access Control

<%= previousTitle %>

<%= nextTitle %>

In this article

<%= heading %>

<% if (!block.description) { %> <%= block.name %> <% } else { %> <%= block.name %> <% } %>

<%= heading %>

<% if (!block.description) { %> <%= parsed.title %> <% } else { %> <%= parsed.title %> <% } %>

User Research

Security Announcements

Still have questions?

Categories

Toggle navigation menu

<%= category.name %>