Adobe Commerce / Magento Open Source Incorrect Authorization Customer Account Takeover

#!/usr/bin/env bash
# check_cve_2026_71362.sh — Detect CVE-2026-71362 patch status
# Usage: bash check_cve_2026_71362.sh /path/to/magento/root
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

MAGE_ROOT="${1:-}"

if [[ -z "$MAGE_ROOT" ]]; then
  echo "[!] Usage: $0 /path/to/magento/root"
  exit 2
fi

if [[ ! -d "$MAGE_ROOT/vendor" ]]; then
  echo "UNKNOWN — $MAGE_ROOT does not appear to be a Magento installation (no vendor/ directory)."
  exit 2
fi

# Method 1: Check via patch-status tool if available
if [[ -x "$MAGE_ROOT/vendor/bin/patch-status" ]] || [[ -f "$MAGE_ROOT/vendor/bin/patch-status" ]]; then
  echo "[*] Checking patch status via vendor/bin/patch-status..."
  PATCH_OUTPUT=$(cd "$MAGE_ROOT" && php vendor/bin/patch-status 2>&1 || true)
  if echo "$PATCH_OUTPUT" | grep -qi '2026-aug\|APSB26-92'; then
    echo "PATCHED — patch-status reports August 2026 security patch applied."
    exit 0
  fi
fi

# Method 2: Check composer.json for version
if [[ -f "$MAGE_ROOT/composer.lock" ]]; then
  echo "[*] Checking installed Commerce/Magento version from composer.lock..."
  # Extract magento/product-community-edition or magento/product-enterprise-edition version
  VERSION=$(php -r '
    $lock = json_decode(file_get_contents("'"$MAGE_ROOT"'/composer.lock"), true);
    foreach ($lock["packages"] ?? [] as $pkg) {
      if (in_array($pkg["name"], ["magento/product-community-edition","magento/product-enterprise-edition","magento/magento2-base"])) {
        echo $pkg["version"] ?? "unknown";
        exit;
      }
    }
    echo "unknown";
  ' 2>/dev/null || echo "unknown")

  echo "[*] Detected version: $VERSION"

  if [[ "$VERSION" == "unknown" ]]; then
    echo "UNKNOWN — could not determine Magento version from composer.lock."
    exit 2
  fi

  # Check if version string contains -2026-aug or later patch indicator
  if echo "$VERSION" | grep -qiE '2026[-.]aug|2026[-.]sep|2026[-.]oct|2026[-.]nov|2026[-.]dec'; then
    echo "PATCHED — version $VERSION includes August 2026 or later security patches."
    exit 0
  fi

  # Check if version is 2.4.9-p* or similar with a patch level at or after aug-2026
  if echo "$VERSION" | grep -qiE '^2\.4\.(4|5|6|7|8|9)'; then
    # Version is in the affected range — check for -2026-jul or earlier
    if echo "$VERSION" | grep -qiE '2026[-.]jul|2026[-.]jun|2026[-.]may|2026[-.]apr|2026[-.]mar|2026[-.]feb|2026[-.]jan|2025'; then
      echo "VULNERABLE — version $VERSION is in the affected range (pre-August 2026 patch)."
      echo "CVE-2026-71362: Adobe Commerce Incorrect Authorization — customer session identity switch account takeover."
      echo "Apply APSB26-92 isolated security patch immediately."
      exit 1
    fi
    # If no date indicator, flag as potentially vulnerable
    echo "VULNERABLE — version $VERSION is in the affected range (2.4.4–2.4.9). No August 2026 patch indicator found."
    echo "Verify manually: cd $MAGE_ROOT && php vendor/bin/patch-status"
    exit 1
  fi
fi

echo "UNKNOWN — could not conclusively determine patch status. Verify manually."
exit 2