CVE-2025-49550: Magento Security feature bypass
Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized access. Exploitation of this issue requires user interaction.
Other sources
Magento versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized access. Exploitation of this issue requires user interaction.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.5-p13 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.6-p11 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.7-p6
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49550?
CVE-2025-49550 is classified as a security vulnerability that allows for unauthorized access under certain conditions.
How do I fix CVE-2025-49550?
To fix CVE-2025-49550, ensure that your Adobe Commerce version is updated to 2.4.4-p14 or later.
What versions of Adobe Commerce are affected by CVE-2025-49550?
CVE-2025-49550 affects Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier.
Can CVE-2025-49550 lead to data breaches?
Yes, CVE-2025-49550 could potentially lead to a security feature bypass, allowing unauthorized access to limited data.
What type of vulnerability is CVE-2025-49550?
CVE-2025-49550 is categorized as an Incorrect Authorization vulnerability.