CVE-2025-24421 Overview
Adobe Commerce contains an Incorrect Authorization vulnerability [CWE-863] that allows a low-privileged authenticated attacker to bypass a security feature and read select data. The flaw affects Adobe Commerce, Adobe Commerce B2B, and Magento Open Source across multiple release trains. Exploitation occurs over the network without any user interaction, making the issue reachable by any account with minimal privileges on the storefront or admin interface. Adobe addressed the vulnerability in security bulletin APSB25-08.
Critical Impact
A low-privileged attacker can bypass authorization controls to read restricted data from affected Adobe Commerce and Magento Open Source deployments over the network.
Affected Products
- Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier
- Adobe Commerce B2B versions 1.5.0, 1.4.2-p3, 1.3.5-p8, 1.3.4-p10, 1.3.3-p11 and earlier
- Magento Open Source versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier
Discovery Timeline
- 2025-02-11 - CVE CVE-2025-24421 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-24421
Vulnerability Analysis
The vulnerability is classified as Incorrect Authorization [CWE-863]. Adobe Commerce fails to properly verify that the requesting account holds the authorization required for a specific operation. A low-privileged attacker with valid credentials can therefore invoke functionality or retrieve data that the platform's access control model was intended to restrict. The result is a security feature bypass leading to disclosure of select data. Because the attack is remote and requires no user interaction, exposed storefronts and B2B portals with self-service registration are directly reachable by attackers holding disposable accounts.
Root Cause
The defect stems from an authorization check that either evaluates the wrong attribute, is missing on a code path, or trusts client-supplied context when validating access to a protected resource. Under CWE-863, the application performs an authorization decision but reaches an incorrect result, permitting a caller to access records or configuration that should require elevated privileges.
Attack Vector
Exploitation is performed over the network against the Adobe Commerce or Magento web interface. The attacker authenticates with a low-privileged account, then issues a crafted request to the vulnerable endpoint. No social engineering or user interaction is needed, and the request executes against the target's own session scope. Refer to the Adobe Security Advisory APSB25-08 for endpoint-level technical details.
No public proof-of-concept code or verified exploit is available at the time of publication, so exploitation mechanics are described in prose only.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2025-24421
Indicators of Compromise
- Repeated authenticated requests from a single account to endpoints returning data associated with other users, orders, or store scopes.
- Access log entries showing low-privileged accounts retrieving resources normally restricted to admin or higher-tier B2B roles.
- Unusual enumeration patterns against REST or GraphQL endpoints shortly after account creation.
Detection Strategies
- Compare the effective role of the authenticated session against the sensitivity of the accessed resource in application logs.
- Alert on anomalous read volumes per account against customer, order, quote, and company endpoints.
- Correlate new low-privilege account registrations with immediate access to non-public API paths.
Monitoring Recommendations
- Enable verbose access logging on the Magento API layer, including authenticated user ID and resource identifier.
- Forward web server and application logs to a centralized analytics platform for behavioral baselining.
- Track HTTP 200 responses to endpoints that typically return 401 or 403 for the caller's role.
How to Mitigate CVE-2025-24421
Immediate Actions Required
- Upgrade Adobe Commerce, Adobe Commerce B2B, and Magento Open Source to the fixed versions listed in Adobe Security Advisory APSB25-08.
- Audit customer, B2B, and admin accounts for unexpected registrations or privilege changes since February 2025.
- Review recent access logs for evidence of low-privileged accounts retrieving restricted data.
Patch Information
Adobe released fixes in security bulletin APSB25-08. Administrators should apply the patched releases that supersede 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, and 2.4.4-p11 for Adobe Commerce and Magento Open Source, and the corresponding B2B module patches for the 1.5.0, 1.4.2, 1.3.5, 1.3.4, and 1.3.3 trains. See the Adobe Security Advisory APSB25-08 for the complete version matrix.
Workarounds
- Restrict access to non-essential API endpoints via web application firewall rules until patches are deployed.
- Disable self-service account registration on merchant sites that do not require it, reducing the pool of low-privileged attackers.
- Enforce IP allow-listing for administrative and B2B portals where feasible.
# Verify installed Adobe Commerce / Magento version before and after patching
php bin/magento --version
# Apply the vendor-supplied composer patch package, then run:
composer update
php bin/magento setup:upgrade
php bin/magento setup:di:compile
php bin/magento cache:flush
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
