CVE-2025-24434: Magento Community Edition Improper Authorization Vulnerability
Summary
CVE-2025-24434: Improper Authorization vulnerability in Magento and Adobe Commerce. Affects magento/community-edition across 5 version ranges.
< 2.4.4-p12
>= 2.4.5-p1, < 2.4.5-p11
>= 2.4.6-p1, < 2.4.6-p9
>= 2.4.7-beta1, < 2.4.7-p4
>= 2.4.8-beta1, < 2.4.8-beta2
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is a widely-used open-source e-commerce platform that provides merchants with a flexible shopping cart system, control over the look, content, and functionality of their online store. It is known for its scalability, customization options, and robust features that cater to businesses of all sizes. However, certain versions of Magento, specifically those mentioned in the vulnerability report, are susceptible to an Improper Authorization vulnerability that could allow unauthorized access and privilege escalation.
Vulnerability Detail
The Improper Authorization vulnerability in Adobe Commerce and Magento Community Edition arises from inadequate security measures that fail to properly restrict user access levels. This flaw allows attackers to bypass authentication mechanisms, potentially leading to session takeover and unauthorized access to sensitive data. The vulnerability affects multiple versions of the software, and exploitation does not require any user interaction, making it particularly dangerous. The impact on confidentiality and integrity is rated as high, with a CVSS score of 9.1.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p122.4.4-p12composer require magento/community-edition:2.4.4-p12 -
>= 2.4.5-p1, < 2.4.5-p112.4.5-p11composer require magento/community-edition:2.4.5-p11 -
>= 2.4.6-p1, < 2.4.6-p92.4.6-p9composer require magento/community-edition:2.4.6-p9 -
>= 2.4.7-beta1, < 2.4.7-p42.4.7-p4composer require magento/community-edition:2.4.7-p4 -
>= 2.4.8-beta1, < 2.4.8-beta22.4.8-beta2composer require magento/community-edition:2.4.8-beta2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider restricting access to sensitive areas of your Magento installation until the patch can be applied. This may involve modifying user roles and permissions to limit access to critical functionalities.
Conclusion
The Improper Authorization vulnerability in Magento Community Edition poses a significant risk, allowing attackers to bypass security measures and gain unauthorized access. It is essential for users of affected versions to apply the necessary patches promptly to mitigate this risk. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for magento/community-edition →
FAQ
The vulnerability is an Improper Authorization issue that allows attackers to gain unauthorized access and escalate privileges.
Affected versions include 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and earlier versions.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner.
The CVSS score for this vulnerability is 9.1, indicating a critical level of risk.
No, exploitation of this vulnerability does not require any user interaction.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
