CVE-2025-24437: Magento Community Edition Improper Access Control Vulnerability
Summary
CVE-2025-24437: Magento Improper Access Control vulnerability. Affects magento/community-edition across 4 version ranges.
< 2.4.4-p12
>= 2.4.5-p1, < 2.4.5-p11
>= 2.4.6-p1, < 2.4.6-p9
>= 2.4.7-beta1, < 2.4.7-p4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is a widely used open-source e-commerce platform that provides a robust framework for online stores. It offers a range of features including product management, customer management, and order processing. However, certain versions of Magento Community Edition have been found to be vulnerable to an improper access control issue, which could allow low-privileged attackers to escalate their privileges and bypass security measures.
Vulnerability Detail
The vulnerability stems from improper access control mechanisms in Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and earlier. This flaw allows a low-privileged attacker to exploit the system without requiring user interaction, potentially leading to unauthorized access and privilege escalation. The vulnerability is classified under CWE-284, indicating a weakness in access control that can have moderate severity implications.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p122.4.4-p12composer require magento/community-edition:2.4.4-p12 -
>= 2.4.5-p1, < 2.4.5-p112.4.5-p11composer require magento/community-edition:2.4.5-p11 -
>= 2.4.6-p1, < 2.4.6-p92.4.6-p9composer require magento/community-edition:2.4.6-p9 -
>= 2.4.7-beta1, < 2.4.7-p42.4.7-p4composer require magento/community-edition:2.4.7-p4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can limit access to sensitive areas of the application by implementing additional authentication measures or restricting user roles until the patch is applied.
Conclusion
In summary, the improper access control vulnerability in Magento Community Edition poses a significant risk of privilege escalation for low-privileged attackers. It is crucial for users to update their installations to the latest patched versions to safeguard their applications.
See every vulnerability recorded for magento/community-edition →
FAQ
The CVSS score of this vulnerability is 5.4, indicating a moderate level of risk.
Affected versions include Magento Community Edition 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and earlier.
No, exploitation of this vulnerability does not require user interaction.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner without needing to sign up.
If immediate updating is not possible, consider implementing additional access controls or monitoring to mitigate the risk until a patch can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
