CVE-2025-49556: Magento has incorrect authorization issue that leads to arbitrary file system read
Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction, and scope is unchanged.
Other sources
Magento has incorrect authorization issue that leads to arbitrary file system read
— Packagist
Magento versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction, and scope is unchanged.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.5-p14 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.6-p12 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.7-p7 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.8-p2 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.9-alpha2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49556?
CVE-2025-49556 has been classified with a high severity due to its potential for security feature bypass.
How do I fix CVE-2025-49556?
To fix CVE-2025-49556, update to the latest version of Adobe Commerce that addresses this vulnerability.
What versions of Adobe Commerce are affected by CVE-2025-49556?
Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by CVE-2025-49556.
What types of attacks can exploit CVE-2025-49556?
CVE-2025-49556 can be exploited to perform unauthorized actions by bypassing security measures in Adobe Commerce.
Is there a workaround for CVE-2025-49556?
There are no known effective workarounds for CVE-2025-49556; updating to a patched version is recommended.