Cross-Site Request Forgery in Adobe Commerce Affects User Privileges

CVE-2025-49555

What is CVE-2025-49555?

Adobe Commerce versions including 2.4.9-alpha1 and earlier are susceptible to a Cross-Site Request Forgery (CSRF) vulnerability. This flaw can enable a privileged attacker to exploit the trust of an authenticated user, leading to unauthorized actions on a vulnerable web application. Such exploitation necessitates the victim’s interaction, typically by visiting a malicious site or clicking on a specially crafted link, resulting in the potential for unauthorized access and manipulation of sensitive data.

References