GHSA-r355-75hw-r8jf

ghsaUSosv

Magento allows incorrect authorization

view advisory published 2025-10-14Licence: CC-BY-4.0

Magento versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-54265US	medium5.9OT elevated	0.55% (46th)	—	2025-10-14
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. An attacker could le…

references

External citations — patches, advisories, analysis.

https://github.com/magento/magento2PACKAGE
https://helpx.adobe.com/security/products/magento/apsb25-94.htmlWEB
https://nvd.nist.gov/vuln/detail/CVE-2025-54265ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan