CVE-2023-29288: 
PHP vulnerability analysis and mitigation

Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier), and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability identified as CVE-2023-29288. This security issue was disclosed on June 13, 2023, as part of Adobe's security bulletin (Adobe Advisory).

The vulnerability is classified as an Incorrect Authorization issue (CWE-863) that could result in a security feature bypass. It has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, indicating network accessibility, low attack complexity, required privileges, no user interaction, and low impact on integrity (NVD).

If exploited, this vulnerability could allow a privileged attacker to modify minor functionality of another user's data. The impact is primarily focused on integrity, with no direct effect on confidentiality or availability (Adobe Advisory).

Adobe has released security updates to address this vulnerability. Users should upgrade to the latest versions of Adobe Commerce: beyond 2.4.6-p1, 2.4.5-p3, or 2.4.4-p4 depending on their current version (Adobe Advisory).