CVE-2025-24420: Adobe Commerce B2B Auth Bypass Vulnerability

CVE-2025-24420 Overview

CVE-2025-24420 is an Incorrect Authorization vulnerability [CWE-863] affecting Adobe Commerce and Adobe Commerce B2B. Affected releases include versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and earlier. A low-privileged authenticated attacker can exploit the flaw over the network to bypass a security feature and modify select data. Exploitation requires no user interaction and does not disclose confidential information or impact availability. Adobe addressed the issue in security bulletin APSB25-08.

Critical Impact
Authenticated attackers with low privileges can bypass authorization checks in Adobe Commerce to alter protected data without user interaction.

Affected Products

Adobe Commerce B2B 1.3.3 through 1.5.0 (including patch levels listed in Adobe advisory APSB25-08)
Adobe Commerce 2.4.4-p11, 2.4.5-p10, 2.4.6-p8, 2.4.7-p3, and 2.4.8-beta1
Earlier unsupported Adobe Commerce releases in the same branches

Discovery Timeline

2025-02-11 - CVE CVE-2025-24420 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24420

Vulnerability Analysis

The flaw resides in an authorization check within Adobe Commerce that fails to correctly validate the acting user's entitlement to modify certain resources. Because the enforcement gap involves data modification only, the impact is scoped to integrity. Attackers cannot read confidential records or disrupt service through this issue alone. However, the ability to alter selected data in an e-commerce backend can influence transactions, catalogs, or B2B account state depending on the affected endpoint. The vulnerability aligns with [CWE-863: Incorrect Authorization], meaning the application performs an authorization decision but reaches the wrong conclusion for the current principal. Adobe classifies the issue as a security feature bypass in advisory APSB25-08.

Root Cause

Adobe Commerce enforces role-based access control across storefront, admin, and B2B workflows. In vulnerable builds, a specific handler fails to reconcile the requester's privileges against the target object before executing a write operation. This inconsistent enforcement allows a user with legitimate low-privilege credentials to reach a code path intended for higher-privileged roles. The Common Weakness Enumeration entry [CWE-863] describes this class of defect precisely.

Attack Vector

Exploitation is network-based and requires an authenticated session with low privileges, such as a customer or basic B2B account. The attacker submits a crafted request to a vulnerable endpoint that skips or misapplies the authorization check. No social engineering or victim interaction is required. Adobe has not published exploit details, and no public proof-of-concept is available at this time.

No verified exploit code is available for CVE-2025-24420. Refer to the Adobe Security Advisory APSB25-08 for vendor-supplied technical details.

Detection Methods for CVE-2025-24420

Indicators of Compromise

Unexpected modifications to B2B company records, quotes, shared catalogs, or customer attributes performed by low-privilege accounts.
Web server logs showing authenticated requests to admin or B2B API endpoints originating from non-admin session cookies.
Audit trail entries where the actor role does not match the sensitivity of the modified object.

Detection Strategies

Review Adobe Commerce access logs and application audit logs for anomalous POST, PUT, or PATCH requests from standard customer accounts.
Correlate authentication events with subsequent data-modification events to identify privilege boundary violations.
Baseline normal B2B user activity and flag deviations, such as catalog or company hierarchy edits by unprivileged users.

Monitoring Recommendations

Forward Adobe Commerce web, application, and database audit logs to a centralized analytics platform for correlation.
Enable verbose logging on B2B and admin API endpoints to capture actor identity, role, and modified fields.
Alert on unexpected changes to sensitive tables such as company, sales_order, or catalog_product_entity outside change-management windows.

How to Mitigate CVE-2025-24420

Immediate Actions Required

Apply the Adobe security updates referenced in APSB25-08 to all affected Adobe Commerce and Commerce B2B installations.
Inventory Adobe Commerce deployments and identify instances running versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, or earlier.
Rotate credentials and review recent activity for any low-privilege accounts that showed unusual write behavior.

Patch Information

Adobe released fixed builds as part of the February 2025 Adobe Commerce security update. Consult the Adobe Security Advisory APSB25-08 for the exact patched versions applicable to Adobe Commerce, Adobe Commerce B2B, and Magento Open Source deployments.

Workarounds

Restrict access to admin and B2B API endpoints to trusted networks using a Web Application Firewall (WAF) or reverse proxy access control lists.
Temporarily disable or downgrade the privileges of unused low-tier accounts until patches are applied.
Enforce strict role assignments in B2B company hierarchies to reduce the pool of accounts that could exercise the flaw.

bash

# Verify installed Adobe Commerce version before and after patching
php bin/magento --version

# Apply the vendor-supplied security patch via Composer (example)
composer require magento/product-community-edition=<patched-version> --no-update
composer update
php bin/magento setup:upgrade
php bin/magento cache:flush