Adobe Commerce | Incorrect Authorization (CWE-863)

Vulnerability

Overview

CVE-2025-54267 is an Incorrect Authorization vulnerability affecting Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15, and earlier. The root cause lies in insufficient access control checks, which allows a low-privileged attacker to bypass intended security measures [1].

Exploitation

An attacker with low privileges can exploit this flaw without any user interaction. The attack does not require social engineering or additional authentication steps beyond the initial low-privileged session. The vulnerability is network-accessible, meaning the attacker only needs to send crafted requests to the affected Adobe Commerce instance [1].

Impact

Successful exploitation enables the attacker to gain unauthorized access to elevated privileges, specifically increasing the integrity impact to high. This means the attacker could modify critical data or system configurations, potentially leading to data corruption, unauthorized changes to product listings, or other integrity violations [1].

Mitigation

Adobe has not yet released a security patch for this vulnerability as of the publication date. Users are advised to monitor the official Adobe Security Bulletin and the Magento Open Source repository [2] for updates. Until a fix is available, administrators should review and restrict low-privileged user permissions and apply network-level controls to limit exposure.