Adobe Commerce | Incorrect Authorization (CWE-863)

Vulnerability

Overview CVE-2025-49556 is an Incorrect Authorization vulnerability in Adobe Commerce affecting versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14, and earlier [1]. The flaw arises from improper authorization checks, enabling a security feature bypass.

Exploitation

An attacker can exploit this vulnerability without any user interaction or authentication prerequisites [1]. The attack surface is network-based, and successful exploitation does not change the scope of the impact, meaning the compromised component remains within its original security boundary.

Impact

The primary impact is unauthorized read access to sensitive information [1]. Depending on the context, this could include customer data, order details, or other confidential information stored within the Adobe Commerce database.

Mitigation

Adobe has released security updates to address this vulnerability as part of their regular patch cycle. Users should upgrade to a patched version (e.g., 2.4.9-alpha1 or later) to remediate the issue [2]. No workarounds have been published at this time.