CVE-2025-24418
Adobe Commerce | Improper Authorization (CWE-285)
At a glance Severity HIGH 8.1 EPSS EPSS 0.96 % · percentile 61 (2026-10-27) State PUBLISHED Published 2025-02-11 Updated 2026-02-26 Assigner adobe NVD status Analyzed Description Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.
Scores Version Score Vector Scored by CVSS 3.1 HIGH 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N adobe CVSS 3.1 HIGH 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N NVD · psirt@adobe.com (Secondary) CVSS 3.1 HIGH 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:adobe:commerce_b2b:*:*:*:*:*:*:*:* < 1.3.3cpe:2.3:a:adobe:commerce_b2b:1.3.3:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce_b2b:1.3.3:p10:*:*:*:*:*:*cpe:2.3:a:adobe:commerce_b2b:1.3.3:p11:*:*:*:*:*:*cpe:2.3:a:adobe:commerce_b2b:1.3.4:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce_b2b:1.3.4:p10:*:*:*:*:*:*cpe:2.3:a:adobe:commerce_b2b:1.3.4:p9:*:*:*:*:*:*cpe:2.3:a:adobe:commerce_b2b:1.3.5:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce_b2b:1.3.5:p7:*:*:*:*:*:*cpe:2.3:a:adobe:commerce_b2b:1.3.5:p8:*:*:*:*:*:*cpe:2.3:a:adobe:commerce_b2b:1.4.2:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce_b2b:1.4.2:p1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce_b2b:1.4.2:p2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce_b2b:1.4.2:p3:*:*:*:*:*:*cpe:2.3:a:adobe:commerce_b2b:1.5.0:*:*:*:*:*:*:*Affected products
References
Sources
