Adobe Commerce | Incorrect Authorization (CWE-863)
Summary
| CVE | CVE-2025-54265 |
|---|---|
| State | PUBLISHED |
| Assigner | adobe |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2025-10-14 21:15:35 UTC |
| Updated | 2026-04-28 03:16:01 UTC |
| Description | Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. |
Risk And Classification
Primary CVSS: v3.1 7.5 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Problem Types: CWE-863 | CWE-863 Incorrect Authorization (CWE-863)
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 3.1 | [email protected] | Secondary | 5.9 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 3.1 | CNA | CVSS | 5.9 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Adobe | Commerce | 2.4.4 | - | All | All |
| Application | Adobe | Commerce | 2.4.4 | p1 | All | All |
| Application | Adobe | Commerce | 2.4.4 | p10 | All | All |
| Application | Adobe | Commerce | 2.4.4 | p11 | All | All |
| Application | Adobe | Commerce | 2.4.4 | p12 | All | All |
| Application | Adobe | Commerce | 2.4.4 | p13 | All | All |
| Application | Adobe | Commerce | 2.4.4 | p14 | All | All |
| Application | Adobe | Commerce | 2.4.4 | p15 | All | All |
| Application | Adobe | Commerce | 2.4.4 | p2 | All | All |
| Application | Adobe | Commerce | 2.4.4 | p3 | All | All |
| Application | Adobe | Commerce | 2.4.4 | p4 | All | All |
| Application | Adobe | Commerce | 2.4.4 | p5 | All | All |
| Application | Adobe | Commerce | 2.4.4 | p6 | All | All |
| Application | Adobe | Commerce | 2.4.4 | p7 | All | All |
| Application | Adobe | Commerce | 2.4.4 | p8 | All | All |
| Application | Adobe | Commerce | 2.4.4 | p9 | All | All |
| Application | Adobe | Commerce | 2.4.5 | - | All | All |
| Application | Adobe | Commerce | 2.4.5 | p1 | All | All |
| Application | Adobe | Commerce | 2.4.5 | p10 | All | All |
| Application | Adobe | Commerce | 2.4.5 | p11 | All | All |
| Application | Adobe | Commerce | 2.4.5 | p12 | All | All |
| Application | Adobe | Commerce | 2.4.5 | p13 | All | All |
| Application | Adobe | Commerce | 2.4.5 | p14 | All | All |
| Application | Adobe | Commerce | 2.4.5 | p2 | All | All |
| Application | Adobe | Commerce | 2.4.5 | p3 | All | All |
| Application | Adobe | Commerce | 2.4.5 | p4 | All | All |
| Application | Adobe | Commerce | 2.4.5 | p5 | All | All |
| Application | Adobe | Commerce | 2.4.5 | p6 | All | All |
| Application | Adobe | Commerce | 2.4.5 | p7 | All | All |
| Application | Adobe | Commerce | 2.4.5 | p8 | All | All |
| Application | Adobe | Commerce | 2.4.5 | p9 | All | All |
| Application | Adobe | Commerce | 2.4.6 | - | All | All |
| Application | Adobe | Commerce | 2.4.6 | p1 | All | All |
| Application | Adobe | Commerce | 2.4.6 | p10 | All | All |
| Application | Adobe | Commerce | 2.4.6 | p11 | All | All |
| Application | Adobe | Commerce | 2.4.6 | p12 | All | All |
| Application | Adobe | Commerce | 2.4.6 | p2 | All | All |
| Application | Adobe | Commerce | 2.4.6 | p3 | All | All |
| Application | Adobe | Commerce | 2.4.6 | p4 | All | All |
| Application | Adobe | Commerce | 2.4.6 | p5 | All | All |
| Application | Adobe | Commerce | 2.4.6 | p6 | All | All |
| Application | Adobe | Commerce | 2.4.6 | p7 | All | All |
| Application | Adobe | Commerce | 2.4.6 | p8 | All | All |
| Application | Adobe | Commerce | 2.4.6 | p9 | All | All |
| Application | Adobe | Commerce | 2.4.7 | - | All | All |
| Application | Adobe | Commerce | 2.4.7 | b1 | All | All |
| Application | Adobe | Commerce | 2.4.7 | b2 | All | All |
| Application | Adobe | Commerce | 2.4.7 | beta3 | All | All |
| Application | Adobe | Commerce | 2.4.7 | p1 | All | All |
| Application | Adobe | Commerce | 2.4.7 | p2 | All | All |
| Application | Adobe | Commerce | 2.4.7 | p3 | All | All |
| Application | Adobe | Commerce | 2.4.7 | p4 | All | All |
| Application | Adobe | Commerce | 2.4.7 | p5 | All | All |
| Application | Adobe | Commerce | 2.4.7 | p6 | All | All |
| Application | Adobe | Commerce | 2.4.7 | p7 | All | All |
| Application | Adobe | Commerce | 2.4.8 | - | All | All |
| Application | Adobe | Commerce | 2.4.8 | beta1 | All | All |
| Application | Adobe | Commerce | 2.4.8 | beta2 | All | All |
| Application | Adobe | Commerce | 2.4.8 | p1 | All | All |
| Application | Adobe | Commerce | 2.4.8 | p2 | All | All |
| Application | Adobe | Commerce | 2.4.9 | alpha1 | All | All |
| Application | Adobe | Commerce | 2.4.9 | alpha2 | All | All |
| Application | Adobe | Commerce B2b | 1.3.3 | - | All | All |
| Application | Adobe | Commerce B2b | 1.3.3 | p1 | All | All |
| Application | Adobe | Commerce B2b | 1.3.3 | p10 | All | All |
| Application | Adobe | Commerce B2b | 1.3.3 | p11 | All | All |
| Application | Adobe | Commerce B2b | 1.3.3 | p12 | All | All |
| Application | Adobe | Commerce B2b | 1.3.3 | p13 | All | All |
| Application | Adobe | Commerce B2b | 1.3.3 | p14 | All | All |
| Application | Adobe | Commerce B2b | 1.3.3 | p15 | All | All |
| Application | Adobe | Commerce B2b | 1.3.3 | p2 | All | All |
| Application | Adobe | Commerce B2b | 1.3.3 | p3 | All | All |
| Application | Adobe | Commerce B2b | 1.3.3 | p4 | All | All |
| Application | Adobe | Commerce B2b | 1.3.3 | p5 | All | All |
| Application | Adobe | Commerce B2b | 1.3.3 | p6 | All | All |
| Application | Adobe | Commerce B2b | 1.3.3 | p7 | All | All |
| Application | Adobe | Commerce B2b | 1.3.3 | p8 | All | All |
| Application | Adobe | Commerce B2b | 1.3.3 | p9 | All | All |
| Application | Adobe | Commerce B2b | 1.3.4 | - | All | All |
| Application | Adobe | Commerce B2b | 1.3.4 | p1 | All | All |
| Application | Adobe | Commerce B2b | 1.3.4 | p10 | All | All |
| Application | Adobe | Commerce B2b | 1.3.4 | p11 | All | All |
| Application | Adobe | Commerce B2b | 1.3.4 | p12 | All | All |
| Application | Adobe | Commerce B2b | 1.3.4 | p13 | All | All |
| Application | Adobe | Commerce B2b | 1.3.4 | p14 | All | All |
| Application | Adobe | Commerce B2b | 1.3.4 | p2 | All | All |
| Application | Adobe | Commerce B2b | 1.3.4 | p3 | All | All |
| Application | Adobe | Commerce B2b | 1.3.4 | p4 | All | All |
| Application | Adobe | Commerce B2b | 1.3.4 | p5 | All | All |
| Application | Adobe | Commerce B2b | 1.3.4 | p6 | All | All |
| Application | Adobe | Commerce B2b | 1.3.4 | p7 | All | All |
| Application | Adobe | Commerce B2b | 1.3.4 | p8 | All | All |
| Application | Adobe | Commerce B2b | 1.3.4 | p9 | All | All |
| Application | Adobe | Commerce B2b | 1.3.5 | - | All | All |
| Application | Adobe | Commerce B2b | 1.3.5 | p1 | All | All |
| Application | Adobe | Commerce B2b | 1.3.5 | p10 | All | All |
| Application | Adobe | Commerce B2b | 1.3.5 | p11 | All | All |
| Application | Adobe | Commerce B2b | 1.3.5 | p12 | All | All |
| Application | Adobe | Commerce B2b | 1.3.5 | p2 | All | All |
| Application | Adobe | Commerce B2b | 1.3.5 | p3 | All | All |
| Application | Adobe | Commerce B2b | 1.3.5 | p4 | All | All |
| Application | Adobe | Commerce B2b | 1.3.5 | p5 | All | All |
| Application | Adobe | Commerce B2b | 1.3.5 | p6 | All | All |
| Application | Adobe | Commerce B2b | 1.3.5 | p7 | All | All |
| Application | Adobe | Commerce B2b | 1.3.5 | p8 | All | All |
| Application | Adobe | Commerce B2b | 1.3.5 | p9 | All | All |
| Application | Adobe | Commerce B2b | 1.4.2 | - | All | All |
| Application | Adobe | Commerce B2b | 1.4.2 | p1 | All | All |
| Application | Adobe | Commerce B2b | 1.4.2 | p2 | All | All |
| Application | Adobe | Commerce B2b | 1.4.2 | p3 | All | All |
| Application | Adobe | Commerce B2b | 1.4.2 | p4 | All | All |
| Application | Adobe | Commerce B2b | 1.4.2 | p5 | All | All |
| Application | Adobe | Commerce B2b | 1.4.2 | p6 | All | All |
| Application | Adobe | Commerce B2b | 1.4.2 | p7 | All | All |
| Application | Adobe | Commerce B2b | 1.5.2 | - | All | All |
| Application | Adobe | Commerce B2b | 1.5.2 | p1 | All | All |
| Application | Adobe | Commerce B2b | 1.5.2 | p2 | All | All |
| Application | Adobe | Commerce B2b | 1.5.3 | alpha1 | All | All |
| Application | Adobe | Commerce B2b | 1.5.3 | alpha2 | All | All |
| Application | Adobe | Magento | 2.4.6 | - | All | All |
| Application | Adobe | Magento | 2.4.6 | p1 | All | All |
| Application | Adobe | Magento | 2.4.6 | p10 | All | All |
| Application | Adobe | Magento | 2.4.6 | p11 | All | All |
| Application | Adobe | Magento | 2.4.6 | p12 | All | All |
| Application | Adobe | Magento | 2.4.6 | p2 | All | All |
| Application | Adobe | Magento | 2.4.6 | p3 | All | All |
| Application | Adobe | Magento | 2.4.6 | p4 | All | All |
| Application | Adobe | Magento | 2.4.6 | p5 | All | All |
| Application | Adobe | Magento | 2.4.6 | p6 | All | All |
| Application | Adobe | Magento | 2.4.6 | p7 | All | All |
| Application | Adobe | Magento | 2.4.6 | p8 | All | All |
| Application | Adobe | Magento | 2.4.6 | p9 | All | All |
| Application | Adobe | Magento | 2.4.7 | - | All | All |
| Application | Adobe | Magento | 2.4.7 | b1 | All | All |
| Application | Adobe | Magento | 2.4.7 | b2 | All | All |
| Application | Adobe | Magento | 2.4.7 | beta3 | All | All |
| Application | Adobe | Magento | 2.4.7 | p1 | All | All |
| Application | Adobe | Magento | 2.4.7 | p2 | All | All |
| Application | Adobe | Magento | 2.4.7 | p3 | All | All |
| Application | Adobe | Magento | 2.4.7 | p4 | All | All |
| Application | Adobe | Magento | 2.4.7 | p5 | All | All |
| Application | Adobe | Magento | 2.4.7 | p6 | All | All |
| Application | Adobe | Magento | 2.4.7 | p7 | All | All |
| Application | Adobe | Magento | 2.4.8 | - | All | All |
| Application | Adobe | Magento | 2.4.8 | beta1 | All | All |
| Application | Adobe | Magento | 2.4.8 | beta2 | All | All |
| Application | Adobe | Magento | 2.4.8 | p1 | All | All |
| Application | Adobe | Magento | 2.4.8 | p2 | All | All |
| Application | Adobe | Magento | 2.4.9 | alpha1 | All | All |
| Application | Adobe | Magento | 2.4.9 | alpha2 | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Adobe | Adobe Commerce | affected 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| helpx.adobe.com/security/products/magento/apsb25-94.html | [email protected] | helpx.adobe.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.