CVE-2025-27188: Adobe Commerce | Incorrect Authorization (CWE-863)
First published: Tue Apr 08 2025(Updated: )
Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Adobe Magento Commerce | <2.4.8-beta2 | |
| Adobe Magento Commerce | <2.4.4 | |
| Adobe Magento Commerce | =2.4.4 | |
| Adobe Magento Commerce | =2.4.4-p1 | |
| Adobe Magento Commerce | =2.4.4-p10 | |
| Adobe Magento Commerce | =2.4.4-p11 | |
| Adobe Magento Commerce | =2.4.4-p12 | |
| Adobe Magento Commerce | =2.4.4-p2 | |
| Adobe Magento Commerce | =2.4.4-p3 | |
| Adobe Magento Commerce | =2.4.4-p4 | |
| Adobe Magento Commerce | =2.4.4-p5 | |
| Adobe Magento Commerce | =2.4.4-p6 | |
| Adobe Magento Commerce | =2.4.4-p7 | |
| Adobe Magento Commerce | =2.4.4-p8 | |
| Adobe Magento Commerce | =2.4.4-p9 | |
| Adobe Magento Commerce | =2.4.5 | |
| Adobe Magento Commerce | =2.4.5-p1 | |
| Adobe Magento Commerce | =2.4.5-p10 | |
| Adobe Magento Commerce | =2.4.5-p11 | |
| Adobe Magento Commerce | =2.4.5-p2 | |
| Adobe Magento Commerce | =2.4.5-p3 | |
| Adobe Magento Commerce | =2.4.5-p4 | |
| Adobe Magento Commerce | =2.4.5-p5 | |
| Adobe Magento Commerce | =2.4.5-p6 | |
| Adobe Magento Commerce | =2.4.5-p7 | |
| Adobe Magento Commerce | =2.4.5-p8 | |
| Adobe Magento Commerce | =2.4.5-p9 | |
| Adobe Magento Commerce | =2.4.6 | |
| Adobe Magento Commerce | =2.4.6-p1 | |
| Adobe Magento Commerce | =2.4.6-p2 | |
| Adobe Magento Commerce | =2.4.6-p3 | |
| Adobe Magento Commerce | =2.4.6-p4 | |
| Adobe Magento Commerce | =2.4.6-p5 | |
| Adobe Magento Commerce | =2.4.6-p6 | |
| Adobe Magento Commerce | =2.4.6-p7 | |
| Adobe Magento Commerce | =2.4.6-p8 | |
| Adobe Magento Commerce | =2.4.6-p9 | |
| Adobe Magento Commerce | =2.4.7 | |
| Adobe Magento Commerce | =2.4.7-p1 | |
| Adobe Magento Commerce | =2.4.7-p2 | |
| Adobe Magento Commerce | =2.4.7-p3 | |
| Adobe Magento Commerce | =2.4.7-p4 | |
| Adobe Magento Commerce | =2.4.8-beta2 | |
| Adobe Commerce | <1.3.3 | |
| Adobe Commerce | =1.3.3 | |
| Adobe Commerce | =1.3.3-p10 | |
| Adobe Commerce | =1.3.3-p11 | |
| Adobe Commerce | =1.3.3-p12 | |
| Adobe Commerce | =1.3.4 | |
| Adobe Commerce | =1.3.4-p10 | |
| Adobe Commerce | =1.3.4-p11 | |
| Adobe Commerce | =1.3.4-p9 | |
| Adobe Commerce | =1.3.5 | |
| Adobe Commerce | =1.3.5-p7 | |
| Adobe Commerce | =1.3.5-p8 | |
| Adobe Commerce | =1.3.5-p9 | |
| Adobe Commerce | =1.4.2 | |
| Adobe Commerce | =1.4.2-p1 | |
| Adobe Commerce | =1.4.2-p2 | |
| Adobe Commerce | =1.4.2-p3 | |
| Adobe Commerce | =1.4.2-p4 | |
| Adobe Commerce | =1.5.0 | |
| Adobe Commerce | =1.5.1 | |
| Magento | <2.4.4 | |
| Magento | =2.4.4 | |
| Magento | =2.4.4-p1 | |
| Magento | =2.4.4-p10 | |
| Magento | =2.4.4-p11 | |
| Magento | =2.4.4-p12 | |
| Magento | =2.4.4-p2 | |
| Magento | =2.4.4-p3 | |
| Magento | =2.4.4-p4 | |
| Magento | =2.4.4-p5 | |
| Magento | =2.4.4-p6 | |
| Magento | =2.4.4-p7 | |
| Magento | =2.4.4-p8 | |
| Magento | =2.4.4-p9 | |
| Magento | =2.4.5 | |
| Magento | =2.4.5-p1 | |
| Magento | =2.4.5-p10 | |
| Magento | =2.4.5-p11 | |
| Magento | =2.4.5-p2 | |
| Magento | =2.4.5-p3 | |
| Magento | =2.4.5-p4 | |
| Magento | =2.4.5-p5 | |
| Magento | =2.4.5-p6 | |
| Magento | =2.4.5-p7 | |
| Magento | =2.4.5-p8 | |
| Magento | =2.4.5-p9 | |
| Magento | =2.4.6 | |
| Magento | =2.4.6-p1 | |
| Magento | =2.4.6-p2 | |
| Magento | =2.4.6-p3 | |
| Magento | =2.4.6-p4 | |
| Magento | =2.4.6-p5 | |
| Magento | =2.4.6-p6 | |
| Magento | =2.4.6-p7 | |
| Magento | =2.4.6-p8 | |
| Magento | =2.4.6-p9 | |
| Magento | =2.4.7 | |
| Magento | =2.4.7-p1 | |
| Magento | =2.4.7-p2 | |
| Magento | =2.4.7-p3 | |
| Magento | =2.4.7-p4 | |
| Magento | =2.4.8-beta1 | |
| Magento | =2.4.8-beta2 | |
| composer/magento/community-edition | >=2.4.8-beta1<2.4.8 | 2.4.8 |
| composer/magento/community-edition | =2.4.7 | |
| composer/magento/community-edition | >=2.4.7-p1<2.4.7-p5 | 2.4.7-p5 |
| composer/magento/community-edition | >=2.4.6-p1<2.4.6-p10 | 2.4.6-p10 |
| composer/magento/community-edition | >=2.4.5-p1<2.4.5-p12 | 2.4.5-p12 |
| composer/magento/community-edition | =2.4.6 | |
| composer/magento/community-edition | =2.4.5 | |
| composer/magento/community-edition | =2.4.4 | |
| composer/magento/community-edition | <2.4.4-p13 | 2.4.4-p13 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-27188?
CVE-2025-27188 has been classified as a high-severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2025-27188?
To fix CVE-2025-27188, ensure that your Adobe Commerce installation is updated to a version later than 2.4.8-beta2.
What types of attacks can CVE-2025-27188 enable?
CVE-2025-27188 can enable attacks that result in privilege escalation, allowing unauthorized access to sensitive areas of the application.
Which software versions are affected by CVE-2025-27188?
CVE-2025-27188 affects Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, and 2.4.8-beta2 and earlier.
What should I do if I cannot immediately update my Adobe Commerce application due to CVE-2025-27188?
If immediate updates are not possible, implement comprehensive security measures to limit access and monitor for suspicious activity.
- agent/type
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/author
- agent/severity
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-rr2g-rrjj-xw86
- alias/CVE-2025-27188
- agent/source
- agent/references
- agent/description
- agent/softwarecombine
- agent/tags
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/nvd-cve
- collector/github-advisory
- vendor/adobe
- canonical/adobe magento commerce
- package-manager/composer
- version/adobe magento commerce/2.4.4
- version/adobe magento commerce/2.4.4-p1
- version/adobe magento commerce/2.4.4-p10
- version/adobe magento commerce/2.4.4-p11
- version/adobe magento commerce/2.4.4-p12
- version/adobe magento commerce/2.4.4-p2
- version/adobe magento commerce/2.4.4-p3
- version/adobe magento commerce/2.4.4-p4
- version/adobe magento commerce/2.4.4-p5
- version/adobe magento commerce/2.4.4-p6
- version/adobe magento commerce/2.4.4-p7
- version/adobe magento commerce/2.4.4-p8
- version/adobe magento commerce/2.4.4-p9
- version/adobe magento commerce/2.4.5
- version/adobe magento commerce/2.4.5-p1
- version/adobe magento commerce/2.4.5-p10
- version/adobe magento commerce/2.4.5-p11
- version/adobe magento commerce/2.4.5-p2
- version/adobe magento commerce/2.4.5-p3
- version/adobe magento commerce/2.4.5-p4
- version/adobe magento commerce/2.4.5-p5
- version/adobe magento commerce/2.4.5-p6
- version/adobe magento commerce/2.4.5-p7
- version/adobe magento commerce/2.4.5-p8
- version/adobe magento commerce/2.4.5-p9
- version/adobe magento commerce/2.4.6
- version/adobe magento commerce/2.4.6-p1
- version/adobe magento commerce/2.4.6-p2
- version/adobe magento commerce/2.4.6-p3
- version/adobe magento commerce/2.4.6-p4
- version/adobe magento commerce/2.4.6-p5
- version/adobe magento commerce/2.4.6-p6
- version/adobe magento commerce/2.4.6-p7
- version/adobe magento commerce/2.4.6-p8
- version/adobe magento commerce/2.4.6-p9
- version/adobe magento commerce/2.4.7
- version/adobe magento commerce/2.4.7-p1
- version/adobe magento commerce/2.4.7-p2
- version/adobe magento commerce/2.4.7-p3
- version/adobe magento commerce/2.4.7-p4
- version/adobe magento commerce/2.4.8-beta2
- canonical/adobe commerce
- version/adobe commerce/1.3.3
- version/adobe commerce/1.3.3-p10
- version/adobe commerce/1.3.3-p11
- version/adobe commerce/1.3.3-p12
- version/adobe commerce/1.3.4
- version/adobe commerce/1.3.4-p10
- version/adobe commerce/1.3.4-p11
- version/adobe commerce/1.3.4-p9
- version/adobe commerce/1.3.5
- version/adobe commerce/1.3.5-p7
- version/adobe commerce/1.3.5-p8
- version/adobe commerce/1.3.5-p9
- version/adobe commerce/1.4.2
- version/adobe commerce/1.4.2-p1
- version/adobe commerce/1.4.2-p2
- version/adobe commerce/1.4.2-p3
- version/adobe commerce/1.4.2-p4
- version/adobe commerce/1.5.0
- version/adobe commerce/1.5.1
- canonical/magento
- version/magento/2.4.4
- version/magento/2.4.4-p1
- version/magento/2.4.4-p10
- version/magento/2.4.4-p11
- version/magento/2.4.4-p12
- version/magento/2.4.4-p2
- version/magento/2.4.4-p3
- version/magento/2.4.4-p4
- version/magento/2.4.4-p5
- version/magento/2.4.4-p6
- version/magento/2.4.4-p7
- version/magento/2.4.4-p8
- version/magento/2.4.4-p9
- version/magento/2.4.5
- version/magento/2.4.5-p1
- version/magento/2.4.5-p10
- version/magento/2.4.5-p11
- version/magento/2.4.5-p2
- version/magento/2.4.5-p3
- version/magento/2.4.5-p4
- version/magento/2.4.5-p5
- version/magento/2.4.5-p6
- version/magento/2.4.5-p7
- version/magento/2.4.5-p8
- version/magento/2.4.5-p9
- version/magento/2.4.6
- version/magento/2.4.6-p1
- version/magento/2.4.6-p2
- version/magento/2.4.6-p3
- version/magento/2.4.6-p4
- version/magento/2.4.6-p5
- version/magento/2.4.6-p6
- version/magento/2.4.6-p7
- version/magento/2.4.6-p8
- version/magento/2.4.6-p9
- version/magento/2.4.7
- version/magento/2.4.7-p1
- version/magento/2.4.7-p2
- version/magento/2.4.7-p3
- version/magento/2.4.7-p4
- version/magento/2.4.8-beta1
- version/magento/2.4.8-beta2