Magento Commerce Incorrect permissions Could Lead To Unauthorized Access

Magento Commerce has a flaw that allows attackers to access products and information they shouldn't be able to see by manipulating direct object references. This could expose sensitive product data or allow unauthorized users to view restricted resources.

An insecure direct object reference (IDOR) vulnerability exists in Magento's product module where insufficient permission checks allow authenticated or unauthenticated attackers to access restricted resources by directly referencing objects. Exploitation requires manipulating product identifiers or API parameters; successful exploitation leads to unauthorized information disclosure of sensitive product data.