CVE-2025-49556

Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction, and scope is unchanged.

Score

CVSS 3.1 7.5 High

Status

Analyzed - psirt@adobe.com

Published

2025-08-12

Last modified

2025-08-13

Weaknesses

CWE-863

Affected products

• Adobe Commerce (Adobe)
• Commerce (Adobe)
• Commerce B2b (Adobe)
• Magento (Adobe)

References

• https://helpx.adobe.com/security/products/magento/apsb25-71.html