Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Adobe Commerce and Magento may allow unauthorized access

CVE-2025-27191 · published 1 year ago
Summary

Certain older versions of Adobe Commerce and Magento Community Edition let a remote attacker bypass security checks and gain access without any user interaction. This can expose sensitive data or let unwanted changes be made. Update to the latest patched versions or apply the vendor's recommended security update as soon as possible.

What to do
  • Update magento community-edition to version 2.4.7-p5.
  • Update magento community-edition to version 2.4.6-p10.
  • Update magento community-edition to version 2.4.5-p12.
  • Update magento community-edition to version 2.4.4-p13.
  • Update magento community-edition to version 2.4.8-beta2.
  • Update adobe commerce to version 2.4.4 or later.
  • Update adobe commerce_b2b to version 1.3.3 or later.
  • Update adobe magento to version 2.4.4 or later.
Affected software
Ecosystem VendorProductAffected versions
composer magento project-community-edition <= 2.0.2
composer magento community-edition >= 2.4.7-beta1, < 2.4.7-p5
>= 2.4.6-p1, < 2.4.6-p10
>= 2.4.5-p1, < 2.4.5-p12
< 2.4.4-p13
>= 2.4.8-beta1, < 2.4.8-beta2
2.4.5
2.4.4
2.4.6
2.4.7
Fix: upgrade to 2.4.7-p5
– adobe commerce < 2.4.4
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*
– adobe commerce_b2b < 1.3.3
1.3.3
1.3.4
1.3.5
1.4.2
1.5.1
cpe:2.3:a:adobe:commerce_b2b:*:*:*:*:*:*:*:*
– adobe magento < 2.4.4
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
cpe:2.3:a:adobe:magento:*:*:*:*:open_source:*:*:*
Original advisory text
Adobe Commerce | Improper Access Control (CWE-284)
Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-284Improper Access Control
Timeline
Published8 Apr 2025
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-vhcq-4xrm-2cr2 · GHSA
CVE-2025-27191 · NVD
CVE-2025-27191 · OSV
Track software like this
Free during beta