CVE-2025-24419: Adobe Commerce | Incorrect Authorization (CWE-863)
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to modify select data. Exploitation of this issue does not require user interaction.
Affected Software
Event History
Frequently Asked Questions
What is the impact of CVE-2025-24419?
CVE-2025-24419 allows a low-privileged attacker to bypass security features within Adobe Commerce.
Which versions of Adobe Commerce are affected by CVE-2025-24419?
Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected.
How can I mitigate the risk from CVE-2025-24419?
To mitigate CVE-2025-24419, update Adobe Commerce to a version that is not susceptible to this vulnerability.
What type of vulnerability is CVE-2025-24419?
CVE-2025-24419 is classified as an Incorrect Authorization vulnerability.
Who is affected by the exploitation of CVE-2025-24419?
Low-privileged attackers could exploit CVE-2025-24419 to perform unauthorized actions on affected Adobe Commerce installations.