Adobe Commerce | Improper Access Control (CWE-284)

Vulnerability

Overview CVE-2025-24435 is an Improper Access Control vulnerability in Adobe Commerce affecting versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier. The issue lies in inadequate authorization checks, allowing a low-privileged attacker to bypass security restrictions and modify limited fields without proper permissions [1].

Exploitation

Conditions Exploitation requires only low-privileged access to an affected Adobe Commerce instance. No user interaction is needed, making the attack easily scalable. An attacker could leverage existing session or API tokens with minimal privileges to trigger the flawed access control logic [1].

Impact

Successful exploitation results in privilege escalation, enabling the attacker to modify certain fields that should be restricted to higher-privileged roles. This could lead to unauthorized changes to product data, customer information, or configuration settings, potentially affecting store operations and data integrity [1].

Mitigation

Adobe has released patches in versions 2.4.4-p12, 2.4.5-p11, 2.4.6-p9, 2.4.7-p4, and 2.4.8-beta2 (or later). Users are strongly advised to upgrade to a fixed version or apply the official security patch. No workarounds have been publicly documented [1].