CVE-2025-24424 Adobe Commerce | Improper Access Control (CWE-284)

Medium 6.5 Published 11 Feb 2025 Updated 15 Apr 2025

A low-privileged attacker can bypass security measures to gain unauthorized read access in Adobe Commerce without user interaction.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2025-24424?

CVE-2025-24424 is a medium-severity missing authorization vulnerability in Adobe Commerce B2b, published on 11 Feb 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction.

Weakness: CWE-284

Which versions are affected by CVE-2025-24424?

12 open source packages ship an affected version, including magento/community-edition and magento/project-community-edition. It affects 1 product.

Package	Affected	Fixed in
`magento/community-edition` Packagist	All versions	None
`magento/community-edition` Packagist	All versions	None
`magento/community-edition` Packagist	All versions	`2.4.4-p12`
`magento/community-edition` Packagist	All versions	`2.4.4-p12`
`magento/community-edition` Packagist	From `2.4.5-p1`	`2.4.5-p11`
`magento/community-edition` Packagist	From `2.4.5-p1`	`2.4.5-p11`

6 more packages

`magento/community-edition` Packagist	From `2.4.6-p1`	`2.4.6-p9`
`magento/community-edition` Packagist	From `2.4.6-p1`	`2.4.6-p9`
`magento/community-edition` Packagist	From `2.4.7-beta1`	`2.4.7-p4`
`magento/community-edition` Packagist	From `2.4.7-beta1`	`2.4.7-p4`
`magento/project-community-edition` Packagist	All versions to `2.0.2`	None
`magento/project-community-edition` Packagist	All versions to `2.0.2`	None

Products include Adobe Commerce B2b.

How do I fix CVE-2025-24424?

Upgrade magento/community-edition to a fixed version for your release line: 2.4.4-p12, 2.4.5-p11, 2.4.6-p9 or 2.4.7-p4.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-24424 being exploited?

There is no known exploitation of CVE-2025-24424 in the wild and no public exploit code.

All Adobe Commerce B2b vulnerabilities

Sources

Also known as GHSA-539v-w87w-w62c.