CVE-2025-24427: Magento Community Edition Improper Access Control Vulnerability
Summary
CVE-2025-24427: Magento Improper Access Control vulnerability. Affects magento/community-edition across 4 version ranges.
< 2.4.4-p12
>= 2.4.5-p1, < 2.4.5-p11
>= 2.4.6-p1, < 2.4.6-p9
>= 2.4.7-beta1, < 2.4.7-p4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is a widely-used open-source e-commerce platform that provides a flexible shopping cart system, control over the look and feel of the online store, and powerful marketing, search engine optimization, and catalog-management tools. The platform is designed for scalability and customization, making it a popular choice among businesses of all sizes. However, certain versions of Magento have been found to be vulnerable to an improper access control issue, which could allow unauthorized users to bypass security measures.
Vulnerability Detail
Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability. This vulnerability allows low-privileged attackers to bypass security features and gain unauthorized access to sensitive areas of the application without requiring user interaction. The vulnerability is classified under CWE-284, indicating a failure to enforce proper access controls, which can lead to significant security risks, including data breaches and unauthorized actions within the system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p122.4.4-p12composer require magento/community-edition:2.4.4-p12 -
>= 2.4.5-p1, < 2.4.5-p112.4.5-p11composer require magento/community-edition:2.4.5-p11 -
>= 2.4.6-p1, < 2.4.6-p92.4.6-p9composer require magento/community-edition:2.4.6-p9 -
>= 2.4.7-beta1, < 2.4.7-p42.4.7-p4composer require magento/community-edition:2.4.7-p4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that sensitive areas of your Magento installation are protected with additional authentication measures, such as IP whitelisting or two-factor authentication, until the update can be applied.
Conclusion
The Improper Access Control vulnerability in Magento Community Edition poses a significant risk to users of affected versions. It is crucial to update to the latest patched versions to mitigate this risk and ensure the security of your e-commerce platform. Additionally, consider using tools like Vulert for ongoing monitoring of vulnerabilities.
See every vulnerability recorded for magento/community-edition →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
Affected versions include Adobe Commerce 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier.
No, exploitation of this vulnerability does not require user interaction.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Implement additional security measures such as IP whitelisting or two-factor authentication to protect sensitive areas until you can apply the update.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
