Vulnerability advisory

CVE-2025-27188

Adobe Commerce | Incorrect Authorization (CWE-863)

Published Apr 8, 2025Updated Oct 28, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/magento/magento2 ↗
All commits before 0f9a056c8d83c4f319626b3e56ec52a533999f25	`0f9a056c8d83c4f319626b3e56ec52a533999f25`
0f9a056c8d83c4f319626b3e56ec52a533999f25 through c5056c77ddfd62022a4381aae750bf403100e4c7	No fix listed
Also listed as affected (74) `2.4.4-NA` `2.4.4-p1` `2.4.4-p10` `2.4.4-p11` `2.4.4-p12` `2.4.4-p2` `2.4.4-p3` `2.4.4-p4` `2.4.4-p5` `2.4.4-p6` `2.4.4-p7` `2.4.4-p8` `2.4.4-p9` `2.4.5-NA` `2.4.5-p1` `2.4.5-p10` `2.4.5-p11` `2.4.5-p2` `2.4.5-p3` `2.4.5-p4` `2.4.5-p5` `2.4.5-p6` `2.4.5-p7` `2.4.5-p8` `2.4.5-p9` `2.4.6-NA` `2.4.6-p1` `2.4.6-p2` `2.4.6-p3` `2.4.6-p4` `2.4.6-p5` `2.4.6-p6` `2.4.6-p7` `2.4.6-p8` `2.4.6-p9` `2.4.7-NA` `2.4.7-p1` `2.4.7-p2` `2.4.7-p3` `2.4.7-p4` `2.4.8-beta1` `2.4.8-beta2` `2.2.0-RC1.3` `2.2.0-RC1.2` `2.2.0-RC1.1` `2.1.0` `2.1.0-rc3` `2.1.0-rc2` `2.1.0-rc1` `2.0.0` `2.0.0-rc` `0.74.0-beta1` `0.42.0-beta3` `0.1.0-alpha108` `0.42.0-beta1` `0.1.0-alpha107` `0.1.0-alpha106` `0.1.0-alpha105` `0.1.0-alpha104` `0.1.0-alpha103` `0.1.0-alpha102` `0.1.0-alpha101` `0.1.0-alpha100` `0.1.0-alpha99` `0.1.0-alpha98` `0.1.0-alpha97` `0.1.0-alpha96` `0.1.0-alpha95` `0.1.0-alpha94` `0.1.0-alpha93` `0.1.0-alpha92` `0.1.0-alpha91` `0.1.0-alpha90` `0.1.0-alpha89`

Description

Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.

CVE-2025-27188

Affected versions

Repository

Description

References