Adobe Commerce | Improper Access Control (CWE-284)

Vulnerability

Overview CVE-2025-24429 is an Improper Access Control vulnerability in Adobe Commerce affecting versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and earlier. The flaw allows a security feature bypass, enabling unauthorized read-only access to resources that should be restricted [1].

Attack

Vector Exploitation requires a low-privileged attacker with valid credentials. The attacker can trigger the issue through user interaction, such as clicking a malicious link or manipulating a request. The vulnerability stems from insufficient authorization checks, allowing bypass of intended access controls [1].

Impact

Successful exploitation grants the attacker read-only access to sensitive data or functionality. This breach of confidentiality could expose customer information, order details, or other protected content. The attack does not require administrative privileges but relies on the victim's interaction [1].

Mitigation

Adobe has released security updates to address this vulnerability. Users should upgrade to the latest patched versions: 2.4.8 (or later), 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, or higher. No workarounds are documented. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog [1].