CVE-2025-24407: Adobe Commerce B2B Auth Bypass Flaw

CVE-2025-24407 Overview

CVE-2025-24407 is an Incorrect Authorization vulnerability [CWE-863] affecting Adobe Commerce and Adobe Commerce B2B. The flaw allows a low-privileged authenticated attacker to perform actions with permissions that were not granted, bypassing intended security controls. Adobe assigned a CVSS 3.1 base score of 7.1, reflecting high impact to confidentiality and low impact to integrity. Exploitation requires no user interaction and can be carried out over the network. Affected releases include Adobe Commerce 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and earlier versions, along with multiple Adobe Commerce B2B branches in the 1.3.x, 1.4.x, and 1.5.0 lines.

Critical Impact
A low-privileged attacker can bypass authorization checks to access merchant data and modify limited resources without user interaction.

Affected Products

Adobe Commerce 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier
Adobe Commerce B2B 1.3.3 through 1.3.5-p8, 1.4.2 through 1.4.2-p3
Adobe Commerce B2B 1.5.0

Discovery Timeline

2025-02-11 - CVE-2025-24407 published to the National Vulnerability Database (NVD)
2025-02-11 - Adobe publishes security bulletin APSB25-08 with patched versions
2025-04-16 - Last updated in NVD database

Technical Details for CVE-2025-24407

Vulnerability Analysis

The vulnerability is classified under [CWE-863: Incorrect Authorization]. Adobe Commerce performs an authorization check, but the check evaluates permissions incorrectly for specific actions or resources. As a result, an authenticated user with limited privileges can invoke operations that the access control policy should deny.

The attacker accesses confidential merchant or customer data and can perform a bounded set of modifications. Because the vulnerability resides in the authorization logic, traditional input-validation defenses do not block the exploitation path. The flaw affects both standalone Adobe Commerce installations and Adobe Commerce B2B deployments that share the underlying authorization framework.

Root Cause

The root cause is an authorization control that does not correctly enforce the privilege boundary between low-privileged accounts and protected resources. The flawed check permits actions intended for higher-privileged roles when invoked by an attacker who already holds valid credentials. This is a security feature bypass rather than an authentication flaw — the attacker must first authenticate at a low privilege level.

Attack Vector

The attack vector is network-based with low attack complexity. An attacker authenticates to the Adobe Commerce storefront or admin surface using a low-privileged account, such as a customer or limited B2B user. The attacker then issues crafted requests targeting endpoints whose authorization logic is flawed. No user interaction is required, and the scope remains unchanged. See the Adobe Security Advisory APSB25-08 for technical details.

Detection Methods for CVE-2025-24407

Indicators of Compromise

Unexpected access to administrative or restricted REST and GraphQL endpoints from low-privileged customer or B2B accounts
Authorization failures followed shortly by successful requests to the same resource by the same account
Anomalous reads of customer, order, or company data by accounts that do not own those records

Detection Strategies

Review web server and application logs for requests from non-admin sessions to admin-scoped paths under /rest/V1/, /graphql, and /admin/
Correlate session identifiers with the role assigned to the authenticated user, flagging mismatches between role and accessed resource
Hunt for repeated enumeration patterns where a single low-privileged user iterates over object identifiers belonging to other tenants or customers

Monitoring Recommendations

Enable verbose authorization logging in Adobe Commerce and forward logs to a centralized analytics platform for retention and correlation
Monitor for spikes in HTTP 200 responses on endpoints that previously returned 403 for the same account class
Alert on accounts that access disproportionately large volumes of customer, quote, or company records relative to their role

How to Mitigate CVE-2025-24407

Immediate Actions Required

Upgrade Adobe Commerce and Adobe Commerce B2B to the fixed versions listed in Adobe Security Bulletin APSB25-08
Audit existing customer, B2B, and staff accounts and remove any that are inactive, untrusted, or unnecessary
Review recent access logs for evidence of authorization bypass attempts targeting protected endpoints

Patch Information

Adobe released patched builds of Adobe Commerce and Adobe Commerce B2B in security bulletin APSB25-08 on February 11, 2025. Administrators should apply the vendor-supplied updates to all affected branches, including 2.4.7, 2.4.6, 2.4.5, and 2.4.4 maintenance lines, as well as Adobe Commerce B2B 1.3.x, 1.4.x, and 1.5.0.

Workarounds

Restrict access to the Adobe Commerce admin interface using IP allowlists and a web application firewall
Enforce least privilege on customer, company admin, and staff roles, removing permissions not strictly required for business operations
Require multi-factor authentication for all administrative and B2B company-admin accounts to reduce the value of stolen low-privilege credentials

bash

# Verify installed Adobe Commerce version and apply vendor patch
php bin/magento --version
composer require magento/product-community-edition=<patched-version> --no-update
composer update
php bin/magento setup:upgrade
php bin/magento setup:di:compile
php bin/magento cache:flush