CVE-2025-24411: Magento Community Edition Improper Access Control Vulnerability
Summary
CVE-2025-24411: Magento Improper Access Control vulnerability. Affects magento/community-edition across 4 version ranges.
< 2.4.4-p12
>= 2.4.5-p1, < 2.4.5-p11
>= 2.4.6-p1, < 2.4.6-p9
>= 2.4.7-beta1, < 2.4.7-p4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is an open-source e-commerce platform that provides a flexible shopping cart system, control over the look, content, and functionality of online stores. It is widely used by businesses to create and manage their online presence. However, certain versions of Magento are susceptible to an improper access control vulnerability, which can lead to unauthorized access and security feature bypass.
Vulnerability Detail
The vulnerability arises from improper access control mechanisms in Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and earlier. A low-privileged attacker can exploit this flaw to bypass security measures, potentially gaining unauthorized access to sensitive information or functionalities. This vulnerability does not require user interaction, making it particularly dangerous as it can be exploited remotely without any action from the victim.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p122.4.4-p12composer require magento/community-edition:2.4.4-p12 -
>= 2.4.5-p1, < 2.4.5-p112.4.5-p11composer require magento/community-edition:2.4.5-p11 -
>= 2.4.6-p1, < 2.4.6-p92.4.6-p9composer require magento/community-edition:2.4.6-p9 -
>= 2.4.7-beta1, < 2.4.7-p42.4.7-p4composer require magento/community-edition:2.4.7-p4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is recommended to limit access to sensitive areas of the application and monitor user permissions closely until the patch can be applied. Additionally, consider implementing additional security measures such as web application firewalls (WAF) to help mitigate potential exploitation.
Conclusion
In summary, the improper access control vulnerability in Magento Community Edition poses a significant risk to users of affected versions. It is crucial to update to the latest patched versions to safeguard against potential exploitation. Additionally, utilizing tools like Vulert can help monitor for vulnerabilities in real-time.
See every vulnerability recorded for magento/community-edition →
FAQ
CVE-2025-24411 is a vulnerability in Magento Community Edition that allows low-privileged attackers to bypass security controls and gain unauthorized access.
Affected versions include Adobe Commerce 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and earlier.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
If immediate updates are not possible, implement strict access controls and monitor user activities to minimize the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
