CVE-2025-49549: Magento Authenticated Security feature bypass
Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized access. Exploitation of this issue does not require user interaction.
Other sources
Magento Authenticated Security feature bypass
— Packagist
Magento versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized access. Exploitation of this issue does not require user interaction.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.5-p13 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.6-p11 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.7-p6
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49549?
CVE-2025-49549 has been classified as a high severity vulnerability.
How do I fix CVE-2025-49549?
To fix CVE-2025-49549, update Adobe Commerce to version 2.4.9 or later.
What versions of Adobe Commerce are affected by CVE-2025-49549?
Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by CVE-2025-49549.
What type of vulnerability is CVE-2025-49549?
CVE-2025-49549 is categorized as an Incorrect Authorization vulnerability.
What risks does CVE-2025-49549 pose?
CVE-2025-49549 allows a high-privileged attacker to bypass security features, potentially compromising the system.