CVE-2025-49549

Published: Jun 25, 2025Modified: Jul 24, 2025

2.7

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Exploitability: 1.2 / Impact: 1.4

Source: psirt@adobe.com (Secondary)

Description

Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized access. Exploitation of this issue does not require user interaction.

Affected (129)

Products: Adobe: Commerce B2b, Commerce, Magento

3 products

Configuration A

46 vulnerable

Vulnerable Software	Affected Versions
Adobe Commerce B2b	Before 1.3.3
Adobe Commerce B2b	Version 1.3.3
Adobe Commerce B2b	Version 1.3.3 p10
Adobe Commerce B2b	Version 1.3.3 p11
Adobe Commerce B2b	Version 1.3.3 p12
Adobe Commerce B2b	Version 1.3.3 p13
Adobe Commerce B2b	Version 1.3.3 p1
Adobe Commerce B2b	Version 1.3.3 p2
Adobe Commerce B2b	Version 1.3.3 p3
Adobe Commerce B2b	Version 1.3.3 p4
Adobe Commerce B2b	Version 1.3.3 p5
Adobe Commerce B2b	Version 1.3.3 p6
Adobe Commerce B2b	Version 1.3.3 p7
Adobe Commerce B2b	Version 1.3.3 p8
Adobe Commerce B2b	Version 1.3.3 p9
Adobe Commerce B2b	Version 1.3.4
Adobe Commerce B2b	Version 1.3.4 p10
Adobe Commerce B2b	Version 1.3.4 p11
Adobe Commerce B2b	Version 1.3.4 p12
Adobe Commerce B2b	Version 1.3.4 p1
Adobe Commerce B2b	Version 1.3.4 p2
Adobe Commerce B2b	Version 1.3.4 p3
Adobe Commerce B2b	Version 1.3.4 p4
Adobe Commerce B2b	Version 1.3.4 p5
Adobe Commerce B2b	Version 1.3.4 p6
Adobe Commerce B2b	Version 1.3.4 p7
Adobe Commerce B2b	Version 1.3.4 p8
Adobe Commerce B2b	Version 1.3.4 p9
Adobe Commerce B2b	Version 1.3.5
Adobe Commerce B2b	Version 1.3.5 p10
Adobe Commerce B2b	Version 1.3.5 p1
Adobe Commerce B2b	Version 1.3.5 p2
Adobe Commerce B2b	Version 1.3.5 p3
Adobe Commerce B2b	Version 1.3.5 p4
Adobe Commerce B2b	Version 1.3.5 p5
Adobe Commerce B2b	Version 1.3.5 p6
Adobe Commerce B2b	Version 1.3.5 p7
Adobe Commerce B2b	Version 1.3.5 p8
Adobe Commerce B2b	Version 1.3.5 p9
Adobe Commerce B2b	Version 1.4.2
Adobe Commerce B2b	Version 1.4.2 p1
Adobe Commerce B2b	Version 1.4.2 p2
Adobe Commerce B2b	Version 1.4.2 p3
Adobe Commerce B2b	Version 1.4.2 p4
Adobe Commerce B2b	Version 1.4.2 p5
Adobe Commerce B2b	Version 1.5.2

Configuration B

51 vulnerable

Vulnerable Software	Affected Versions
Adobe Commerce	Before 2.4.4
Adobe Commerce	Version 2.4.4
Adobe Commerce	Version 2.4.4 p10
Adobe Commerce	Version 2.4.4 p11
Adobe Commerce	Version 2.4.4 p12
Adobe Commerce	Version 2.4.4 p13
Adobe Commerce	Version 2.4.4 p1
Adobe Commerce	Version 2.4.4 p2
Adobe Commerce	Version 2.4.4 p3
Adobe Commerce	Version 2.4.4 p4
Adobe Commerce	Version 2.4.4 p5
Adobe Commerce	Version 2.4.4 p6
Adobe Commerce	Version 2.4.4 p7
Adobe Commerce	Version 2.4.4 p8
Adobe Commerce	Version 2.4.4 p9
Adobe Commerce	Version 2.4.5
Adobe Commerce	Version 2.4.5 p10
Adobe Commerce	Version 2.4.5 p11
Adobe Commerce	Version 2.4.5 p12
Adobe Commerce	Version 2.4.5 p1
Adobe Commerce	Version 2.4.5 p2
Adobe Commerce	Version 2.4.5 p3
Adobe Commerce	Version 2.4.5 p4
Adobe Commerce	Version 2.4.5 p5
Adobe Commerce	Version 2.4.5 p6
Adobe Commerce	Version 2.4.5 p7
Adobe Commerce	Version 2.4.5 p8
Adobe Commerce	Version 2.4.5 p9
Adobe Commerce	Version 2.4.6
Adobe Commerce	Version 2.4.6 p10
Adobe Commerce	Version 2.4.6 p1
Adobe Commerce	Version 2.4.6 p2
Adobe Commerce	Version 2.4.6 p3
Adobe Commerce	Version 2.4.6 p4
Adobe Commerce	Version 2.4.6 p5
Adobe Commerce	Version 2.4.6 p6
Adobe Commerce	Version 2.4.6 p7
Adobe Commerce	Version 2.4.6 p8
Adobe Commerce	Version 2.4.6 p9
Adobe Commerce	Version 2.4.7
Adobe Commerce	Version 2.4.7 b1
Adobe Commerce	Version 2.4.7 b2
Adobe Commerce	Version 2.4.7 beta3
Adobe Commerce	Version 2.4.7 p1
Adobe Commerce	Version 2.4.7 p2
Adobe Commerce	Version 2.4.7 p3
Adobe Commerce	Version 2.4.7 p4
Adobe Commerce	Version 2.4.7 p5
Adobe Commerce	Version 2.4.8
Adobe Commerce	Version 2.4.8 beta1
Adobe Commerce	Version 2.4.8 beta2

Configuration C

32 vulnerable

Vulnerable Software	Affected Versions
Adobe Magento	Before 2.4.5
Adobe Magento	Version 2.4.5
Adobe Magento	Version 2.4.5 p10
Adobe Magento	Version 2.4.5 p11
Adobe Magento	Version 2.4.5 p12
Adobe Magento	Version 2.4.5 p1
Adobe Magento	Version 2.4.5 p2
Adobe Magento	Version 2.4.5 p3
Adobe Magento	Version 2.4.5 p4
Adobe Magento	Version 2.4.5 p5
Adobe Magento	Version 2.4.5 p6
Adobe Magento	Version 2.4.5 p7
Adobe Magento	Version 2.4.5 p8
Adobe Magento	Version 2.4.5 p9
Adobe Magento	Version 2.4.6
Adobe Magento	Version 2.4.6 p10
Adobe Magento	Version 2.4.6 p1
Adobe Magento	Version 2.4.6 p2
Adobe Magento	Version 2.4.6 p3
Adobe Magento	Version 2.4.6 p4
Adobe Magento	Version 2.4.6 p5
Adobe Magento	Version 2.4.6 p6
Adobe Magento	Version 2.4.6 p7
Adobe Magento	Version 2.4.6 p8
Adobe Magento	Version 2.4.6 p9
Adobe Magento	Version 2.4.7
Adobe Magento	Version 2.4.7 p1
Adobe Magento	Version 2.4.7 p2
Adobe Magento	Version 2.4.7 p3
Adobe Magento	Version 2.4.7 p4
Adobe Magento	Version 2.4.7 p5
Adobe Magento	Version 2.4.8

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (1)

https://helpx.adobe.com/security/products/magento/apsb25-50.html

Source: psirt@adobe.com

Vendor Advisory

Timeline

No history available yet.