Configured Commerce: COM-2026-02 - Broken Access Control

Updated November 10, 2026 21:13

Brief Description:

A high-severity issue concerning broken access control was identified in the Commerce B2B application which allows a storefront user to escalate privileges to an admin user for admin center API endpoints.

Affected Versions:

All versions before 5.2.2608.685+lts and 5.2.2609.401+sts

Solutions and Mitigations:

The application has been updated to remediate the privilege escalation issue.

CVSS and Severity:
CVSS 8.8, High

CVE/CWE ID:
CWE-269

Configured Commerce: COM-2026-02 - Broken Access Control

<%= previousTitle %>

<%= nextTitle %>

In this article

<%= heading %>

<% if (!block.description) { %> <%= block.name %> <% } else { %> <%= block.name %> <% } %>

<%= heading %>

<% if (!block.description) { %> <%= parsed.title %> <% } else { %> <%= parsed.title %> <% } %>

User Research

Security Announcements

Still have questions?

Categories

Toggle navigation menu

<%= category.name %>