Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352)

Vulnerability

Overview

CVE-2025-49555 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14, and earlier [1]. The root cause is insufficient validation of HTTP requests, allowing an attacker to forge requests on behalf of an authenticated victim.

Exploitation

Conditions

Exploitation requires a high-privileged attacker to craft a malicious link or website [1]. The victim must be authenticated to the Adobe Commerce instance and visit the attacker-controlled page or click the crafted link. No additional privileges are needed beyond the attacker's existing high-privileged account. The scope of the vulnerability is changed, indicating potential impact across different security contexts.

Impact

Successful exploitation enables the attacker to perform unintended actions with the victim's privileges, potentially leading to privilege escalation [1]. This could result in unauthorized access to sensitive data or modification of configuration and content within the application.

Mitigation

Adobe has not yet released a specific patch for this CVE, but users are advised to apply the latest security updates from Adobe or restrict access to trusted networks and users until a fix is available. The affected versions are clearly listed, and upgrading to a non-affected version is recommended [1].