Adobe Commerce | Improper Access Control (CWE-284)

Vulnerability

Overview

CVE-2025-27190 is an Improper Access Control vulnerability in Adobe Commerce affecting versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier [1]. The flaw allows an attacker to bypass security features, leading to unauthorized access.

Exploitation

The vulnerability can be exploited without any user interaction, meaning an attacker can trigger it remotely without requiring the victim to perform any action [1]. The exact attack vector is not detailed, but improper access control typically involves manipulating requests or parameters to access restricted resources.

Impact

Successful exploitation results in a security feature bypass, potentially granting the attacker unauthorized access to sensitive data or administrative functions. This could compromise the confidentiality and integrity of the affected Adobe Commerce installation [1].