Adobe Commerce | Improper Access Control (CWE-284)

Root

Cause CVE-2025-24424 is an Improper Access Control vulnerability in Adobe Commerce that affects versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier [1]. The flaw allows an attacker to bypass implemented security measures and gain unauthorized read access to resources that should be protected.

Attack

Vector A low-privileged attacker can exploit this vulnerability without any user interaction [1]. The attacker does not need to trick an administrator or other user; the exploitation can be performed directly against the affected instance. No specific attack vector is disclosed in the available references, but the issue lies in improper enforcement of access controls on certain backend functionality.

Impact

Successful exploitation enables the attacker to bypass security feature restrictions and read sensitive information that should be unavailable to their privilege level [1]. This constitutes a confidentiality breach, potentially exposing customer data, order details, or other protected commerce information.

Mitigation

Adobe has addressed this vulnerability in security updates for the affected versions. Users should upgrade to the latest patched versions of Adobe Commerce or Magento Open Source [2]. No workarounds are publicly documented; applying the vendor-supplied patch is the recommended action.