Product:
Adobe Commerce
Summary
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. A low-privileged attacker could leverage this vulnerability to bypass security measures and maintain unauthorized access. Exploitation of this issue does not require user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.1 | CVE-2025-54263 |
Exploitation
To exploit this vulnerability, an attacker with low privileges can send specially crafted requests to the affected Adobe Commerce application. By doing so, they can bypass the security measures in place, allowing them to gain unauthorized access to sensitive areas of the application without needing any user interaction.
Affected Products
- Adobe Commerce 2.4.9-alpha2: Affected by Incorrect Authorization vulnerability.
- Adobe Commerce 2.4.8-p2: Affected by Incorrect Authorization vulnerability.
- Adobe Commerce 2.4.7-p7: Affected by Incorrect Authorization vulnerability.
- Adobe Commerce 2.4.6-p12: Affected by Incorrect Authorization vulnerability.
- Adobe Commerce 2.4.5-p14: Affected by Incorrect Authorization vulnerability.
- Adobe Commerce 2.4.4-p15: Affected by Incorrect Authorization vulnerability.
Mitigation
To mitigate this vulnerability, it is recommended that users upgrade to the latest version of Adobe Commerce that addresses this issue. Additionally, implementing strict access controls and regularly reviewing user permissions can help reduce the risk of unauthorized access.