CVE-2025-24435: Magento Improper Access Control Vulnerability
Summary
CVE-2025-24435: Magento Improper Access Control vulnerability. Affects magento/community-edition across 4 version ranges.
< 2.4.4-p12
>= 2.4.5-p1, < 2.4.5-p11
>= 2.4.6-p1, < 2.4.6-p9
>= 2.4.7-beta1, < 2.4.7-p4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is a widely used open-source e-commerce platform that provides a flexible shopping cart system, powerful marketing tools, and a customizable interface. It is designed to handle a wide range of e-commerce needs, from small businesses to large enterprises. However, certain versions of Magento have been found to be vulnerable to an improper access control issue, which could allow low-privileged attackers to gain unauthorized access and modify limited fields within the application.
Vulnerability Detail
The vulnerability arises from improper access control mechanisms in Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and earlier. This flaw enables low-privileged attackers to bypass security measures, leading to potential privilege escalation. The exploitation of this vulnerability does not require any user interaction, making it particularly concerning for affected systems. The CWE-284 classification indicates that this issue relates to improper access control, which can have significant ramifications for data integrity and security.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p122.4.4-p12composer require magento/community-edition:2.4.4-p12 -
>= 2.4.5-p1, < 2.4.5-p112.4.5-p11composer require magento/community-edition:2.4.5-p11 -
>= 2.4.6-p1, < 2.4.6-p92.4.6-p9composer require magento/community-edition:2.4.6-p9 -
>= 2.4.7-beta1, < 2.4.7-p42.4.7-p4composer require magento/community-edition:2.4.7-p4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to sensitive areas of the Magento application until the patch can be applied. This can be done by modifying user roles and permissions to limit access for low-privileged users.
Conclusion
The improper access control vulnerability in Magento poses a significant risk to users of affected versions. It is crucial to update to the latest patched versions to mitigate this risk. Additionally, employing temporary workarounds can help protect sensitive areas of the application until the update is applied.
See every vulnerability recorded for magento/community-edition →
FAQ
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
Affected versions include Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and earlier.
No, exploitation of this vulnerability does not require any user interaction.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If immediate updates cannot be performed, consider restricting access to sensitive areas of the application as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
