Vulnerability advisory

CVE-2025-54267

Adobe Commerce | Incorrect Authorization (CWE-863)

Published Oct 14, 2025Updated Oct 28, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/magento/magento2 ↗
0f9a056c8d83c4f319626b3e56ec52a533999f25 through 852c80d4b94feb0a1043812e849b31dc77178935	No fix listed
Also listed as affected (58) `2.4.4-NA` `2.4.4-p1` `2.4.4-p10` `2.4.4-p11` `2.4.4-p12` `2.4.4-p13` `2.4.4-p2` `2.4.4-p3` `2.4.4-p4` `2.4.4-p5` `2.4.4-p6` `2.4.4-p7` `2.4.4-p8` `2.4.4-p9` `2.4.5-NA` `2.4.5-p1` `2.4.5-p10` `2.4.5-p11` `2.4.5-p12` `2.4.5-p13` `2.4.5-p14` `2.4.5-p2` `2.4.5-p3` `2.4.5-p4` `2.4.5-p5` `2.4.5-p6` `2.4.5-p7` `2.4.5-p8` `2.4.5-p9` `2.4.6-NA` `2.4.6-p1` `2.4.6-p10` `2.4.6-p11` `2.4.6-p12` `2.4.6-p2` `2.4.6-p3` `2.4.6-p4` `2.4.6-p5` `2.4.6-p6` `2.4.6-p7` `2.4.6-p8` `2.4.6-p9` `2.4.7-NA` `2.4.7-b1` `2.4.7-b2` `2.4.7-beta3` `2.4.7-p3` `2.4.7-p4` `2.4.7-p5` `2.4.7-p6` `2.4.7-p7` `2.4.8-NA` `2.4.8-beta1` `2.4.8-beta2` `2.4.8-p1` `2.4.8-p2` `2.4.9-alpha1` `2.4.9-alpha2`

Description

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access to elevated privileges that increase integrity impact to high. Exploitation of this issue does not require user interaction.

CVE-2025-54267

Affected versions

Repository

Description

References