Adobe Commerce | Improper Access Control (CWE-284)

What the vulnerability is

CVE-2025-27191 is an improper access control vulnerability in Adobe Commerce affecting versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier [1]. The root cause is a flaw in how the software enforces authorization, allowing an attacker to bypass intended security measures [1].

How it's exploited

Exploitation does not require user interaction, meaning the attack can be carried out without triggering any user action [1]. The vulnerability is network-based and does not require authentication—the attacker simply sends a crafted request to the affected Adobe Commerce instance to bypass access controls [1].

Impact

Successful exploitation results in a security feature bypass, granting the attacker unauthorized access to resources or functionality that should be restricted [1]. This could include reading or modifying sensitive data, performing administrative actions, or accessing restricted areas of the e-commerce platform. The vendor has not provided a CVSS version 4.0 score at the time of publication [1].

Mitigation

As of the publication date (8 April 2025), Adobe has released patched versions to address the vulnerability. Adobe Commerce users should upgrade to 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13, or 2.4.8-beta3 (or later) as applicable. The source code is available through the Magento Open Source repository [2], and it is recommended to apply the security update promptly.