CVE-2025-24435: Adobe Commerce Privilege Escalation Flaw

CVE-2025-24435 Overview

CVE-2025-24435 is an Improper Access Control vulnerability [CWE-284] affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. The flaw allows a low-privileged authenticated attacker to bypass access controls and modify a limited set of fields they should not be able to touch. Exploitation occurs over the network and does not require user interaction. Affected releases include Adobe Commerce 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and earlier. Adobe published a fix in security bulletin APSB25-08.

Critical Impact
An authenticated low-privileged attacker can escalate privileges to modify restricted fields in Adobe Commerce storefronts, potentially altering business-critical data without administrator involvement.

Affected Products

Adobe Commerce 2.4.4 through 2.4.4-p11, 2.4.5 through 2.4.5-p10, 2.4.6 through 2.4.6-p8, 2.4.7 through 2.4.7-p3, and 2.4.8-beta1
Adobe Commerce B2B 1.3.3 through 1.5.0 (including patch releases 1.3.3-p11, 1.3.4-p10, 1.3.5-p8, 1.4.2-p3)
Magento Open Source across the same 2.4.4–2.4.8-beta1 version ranges

Discovery Timeline

2025-02-11 - CVE-2025-24435 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24435

Vulnerability Analysis

The vulnerability is a server-side access control weakness in the Adobe Commerce and Magento platforms. Adobe classifies it as Improper Access Control, mapped to [CWE-284]. A low-privileged account, such as a registered customer or lower-tier merchant user, can send a crafted request that reaches an operation the application should have restricted to higher-privileged roles. The platform accepts and processes the request, permitting the attacker to modify a bounded set of fields on server-side objects.

The impact is scoped to integrity. Confidentiality and availability are not directly affected, and no user interaction is required. The vulnerability is exploitable across the network against any internet-facing Adobe Commerce, Commerce B2B, or Magento Open Source instance running an affected version.

Root Cause

The root cause is missing or insufficient authorization enforcement on one or more storefront or API endpoints. The application relies on the presence of a valid session rather than validating whether the authenticated principal is entitled to perform the requested field-level modification. Adobe has not released the specific endpoint or class involved, and details are only documented in the vendor advisory APSB25-08.

Attack Vector

An attacker authenticates to the target storefront with any low-privileged account. The attacker then submits an HTTP request to an affected endpoint referencing an object owned or governed by a higher-privileged principal. Because the server does not enforce the correct authorization check, the request succeeds and the targeted fields are updated. The action is performed under the attacker's session and requires no phishing, social engineering, or victim interaction.

Adobe has not published proof-of-concept code, and no public exploit is currently listed for this CVE. It is not present in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-24435

Indicators of Compromise

Unexpected field-level modifications on customer, order, quote, or catalog objects performed by non-administrator accounts.
Successful 2xx responses to storefront or REST/GraphQL API calls from low-privileged sessions targeting endpoints normally restricted to admin roles.
Audit-log entries showing entity updates without a corresponding admin session or workflow event.

Detection Strategies

Compare Adobe Commerce application versions against the fixed releases documented in APSB25-08 and flag any instance running an affected version.
Correlate web server access logs with application audit logs to identify update actions initiated by non-admin session tokens.
Baseline normal customer-account API activity and alert on requests that reach administrative or B2B management endpoints.

Monitoring Recommendations

Enable and centralize Magento action logs, REST/GraphQL request logs, and Nginx or Apache access logs.
Monitor for elevated rates of PUT, POST, or PATCH requests from individual customer accounts to storefront APIs.
Track changes to sensitive fields such as pricing, customer group assignment, quote ownership, and B2B company records, and alert on modifications not tied to an admin user.

How to Mitigate CVE-2025-24435

Immediate Actions Required

Inventory all Adobe Commerce, Commerce B2B, and Magento Open Source deployments and identify instances running versions listed in APSB25-08.
Apply the security updates referenced in the Adobe Magento Security Advisory to bring installations to a fixed release.
Audit low-privileged and customer accounts for unexpected object modifications performed after February 11, 2025.

Patch Information

Adobe released fixed builds through security bulletin APSB25-08. Administrators should upgrade to the latest patched release for their branch (later than 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, or 2.4.4-p11). Refer to the Adobe Magento Security Advisory for the exact target versions and download instructions.

Workarounds

Restrict access to non-public REST and GraphQL endpoints at the reverse proxy or web application firewall (WAF) layer where feasible.
Enforce strong registration controls, CAPTCHA, and rate limits on customer account creation to reduce the pool of low-privileged accounts an attacker can use.
Review and tighten Adobe Commerce role and permission assignments so that B2B and merchant accounts hold only the minimum required privileges.

bash

# Verify the installed Adobe Commerce / Magento version before and after patching
php bin/magento --version

# Apply the vendor patch package (example using Composer)
composer require magento/product-community-edition=<fixed-version> --no-update
composer update
php bin/magento setup:upgrade
php bin/magento cache:flush