CVE-2025-27190: Adobe Commerce | Improper Access Control (CWE-284)

Q: What is the severity of CVE-2025-27190?

CVE-2025-27190 is rated as a critical vulnerability due to its potential for security feature bypass.

Q: How do I fix CVE-2025-27190?

To mitigate CVE-2025-27190, upgrade Adobe Commerce to version 2.4.8 or later.

Q: What are the affected versions for CVE-2025-27190?

CVE-2025-27190 affects Adobe Commerce versions up to 2.4.8-beta2.

Q: Who can exploit CVE-2025-27190?

Any attacker with access to the affected system can potentially exploit CVE-2025-27190.

Q: What is the impact of CVE-2025-27190?

CVE-2025-27190 can lead to unauthorized access and potential data manipulation or compromise.

Published Apr 8, 2025

Updated

Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.

Affected Software

109 affected components

Adobe Commerce<2.4.8-beta2

Adobe Commerce=2.4.4

Adobe Commerce=2.4.4-p1

Adobe Commerce=2.4.4-p10

Adobe Commerce=2.4.4-p11

Adobe Commerce=2.4.4-p12

Adobe Commerce=2.4.4-p2

Adobe Commerce=2.4.4-p3

Adobe Commerce=2.4.4-p4

Adobe Commerce=2.4.4-p5

Adobe Commerce=2.4.4-p6

Adobe Commerce=2.4.4-p7

Adobe Commerce=2.4.4-p8

Adobe Commerce=2.4.4-p9

Adobe Commerce=2.4.5

Adobe Commerce=2.4.5-p1

Adobe Commerce=2.4.5-p10

Adobe Commerce=2.4.5-p11

Adobe Commerce=2.4.5-p2

Adobe Commerce=2.4.5-p3

Adobe Commerce=2.4.5-p4

Adobe Commerce=2.4.5-p5

Adobe Commerce=2.4.5-p6

Adobe Commerce=2.4.5-p7

Adobe Commerce=2.4.5-p8

Adobe Commerce=2.4.5-p9

Adobe Commerce=2.4.6

Adobe Commerce=2.4.6-p1

Adobe Commerce=2.4.6-p2

Adobe Commerce=2.4.6-p3

Adobe Commerce=2.4.6-p4

Adobe Commerce=2.4.6-p5

Adobe Commerce=2.4.6-p6

Adobe Commerce=2.4.6-p7

Adobe Commerce=2.4.6-p8

Adobe Commerce=2.4.6-p9

Adobe Commerce=2.4.7

Adobe Commerce=2.4.7-b1

Adobe Commerce=2.4.7-b2

Adobe Commerce=2.4.7-beta3

Adobe Commerce=2.4.7-p1

Adobe Commerce=2.4.7-p2

Adobe Commerce=2.4.7-p3

Adobe Commerce=2.4.7-p4

Adobe Commerce=2.4.8-beta2

Adobe Commerce B2b=1.3.3

Adobe Commerce B2b=1.3.3-p10

Adobe Commerce B2b=1.3.3-p11

Adobe Commerce B2b=1.3.3-p12

Adobe Commerce B2b=1.3.4

Adobe Commerce B2b=1.3.4-p10

Adobe Commerce B2b=1.3.4-p11

Adobe Commerce B2b=1.3.4-p12

Adobe Commerce B2b=1.3.4-p9

Adobe Commerce B2b=1.3.5

Adobe Commerce B2b=1.3.5-p10

Adobe Commerce B2b=1.3.5-p7

Adobe Commerce B2b=1.3.5-p8

Adobe Commerce B2b=1.3.5-p9

Adobe Commerce B2b=1.4.2

Adobe Commerce B2b=1.4.2-p1

Adobe Commerce B2b=1.4.2-p2

Adobe Commerce B2b=1.4.2-p3

Adobe Commerce B2b=1.4.2-p4

Adobe Commerce B2b=1.5.1

Adobe Magento=2.4.4

Adobe Magento=2.4.4-p1

Adobe Magento=2.4.4-p10

Adobe Magento=2.4.4-p11

Adobe Magento=2.4.4-p12

Adobe Magento=2.4.4-p2

Adobe Magento=2.4.4-p3

Adobe Magento=2.4.4-p4

Adobe Magento=2.4.4-p5

Adobe Magento=2.4.4-p6

Adobe Magento=2.4.4-p7

Adobe Magento=2.4.4-p8

Adobe Magento=2.4.4-p9

Adobe Magento=2.4.5

Adobe Magento=2.4.5-p1

Adobe Magento=2.4.5-p10

Adobe Magento=2.4.5-p11

Adobe Magento=2.4.5-p2

Adobe Magento=2.4.5-p3

Adobe Magento=2.4.5-p4

Adobe Magento=2.4.5-p5

Adobe Magento=2.4.5-p6

Adobe Magento=2.4.5-p7

Adobe Magento=2.4.5-p8

Adobe Magento=2.4.5-p9

Adobe Magento=2.4.6

Adobe Magento=2.4.6-p1

Adobe Magento=2.4.6-p2

Adobe Magento=2.4.6-p3

Adobe Magento=2.4.6-p4

Adobe Magento=2.4.6-p5

Adobe Magento=2.4.6-p6

Adobe Magento=2.4.6-p7

Adobe Magento=2.4.6-p8

Adobe Magento=2.4.6-p9

Adobe Magento=2.4.7

Adobe Magento=2.4.7-b1

Adobe Magento=2.4.7-b2

Adobe Magento=2.4.7-beta3

Adobe Magento=2.4.7-p1

Adobe Magento=2.4.7-p2

Adobe Magento=2.4.7-p3

Adobe Magento=2.4.7-p4

Adobe Magento=2.4.8-beta2

Event History

Apr 8, 2025

CVE Published

via MITRE·08:17 PM

Data Sourced

via MITRE·08:17 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-27190?

CVE-2025-27190 is rated as a critical vulnerability due to its potential for security feature bypass.

How do I fix CVE-2025-27190?

To mitigate CVE-2025-27190, upgrade Adobe Commerce to version 2.4.8 or later.

What are the affected versions for CVE-2025-27190?

CVE-2025-27190 affects Adobe Commerce versions up to 2.4.8-beta2.

Who can exploit CVE-2025-27190?

Any attacker with access to the affected system can potentially exploit CVE-2025-27190.

What is the impact of CVE-2025-27190?