CVE-2025-24429: Magento Community Edition Improper Access Control Vulnerability
Summary
CVE-2025-24429: Magento Improper Access Control vulnerability. Affects magento/community-edition across 4 version ranges.
< 2.4.4-p12
>= 2.4.5-p1, < 2.4.5-p11
>= 2.4.6-p1, < 2.4.6-p9
>= 2.4.7-beta1, < 2.4.7-p4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is an open-source e-commerce platform that provides a flexible shopping cart system, control over the look, content, and functionality of online stores. It is widely used for building and managing online retail websites. However, certain versions of Magento Community Edition have been found to have an improper access control vulnerability, which can lead to unauthorized access and security feature bypass.
Vulnerability Detail
The vulnerability arises from improper access control mechanisms in Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and earlier. A low-privileged attacker can exploit this flaw to bypass security measures, gaining unauthorized access to sensitive functionalities without requiring user interaction. This could potentially lead to data breaches or unauthorized actions within the application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p122.4.4-p12composer require magento/community-edition:2.4.4-p12 -
>= 2.4.5-p1, < 2.4.5-p112.4.5-p11composer require magento/community-edition:2.4.5-p11 -
>= 2.4.6-p1, < 2.4.6-p92.4.6-p9composer require magento/community-edition:2.4.6-p9 -
>= 2.4.7-beta1, < 2.4.7-p42.4.7-p4composer require magento/community-edition:2.4.7-p4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that access controls are strictly enforced and monitor user permissions closely until the patch can be applied. Regularly review user roles and permissions to minimize potential exploitation.
Conclusion
In summary, the improper access control vulnerability in Magento Community Edition poses a risk of unauthorized access and security feature bypass. It is crucial to update to the patched versions to safeguard your application. Regular monitoring and strict access control measures can help mitigate risks until updates are applied.
See every vulnerability recorded for magento/community-edition →
FAQ
The affected versions include Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and earlier.
The CVSS score of this vulnerability is 3.5, indicating a low severity level.
No, exploitation of this vulnerability does not require user interaction.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without any signup.
If immediate updates are not possible, ensure strict access controls and monitor user permissions closely to mitigate potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
