Incorrect Authorization Vulnerability in Adobe Commerce Products
CVE-2025-54265

5.9MEDIUM

Key Information:

Vendor

Adobe
Status
Adobe Commerce
Vendor
CVE Published:
14 October 2025

What is CVE-2025-54265?

Adobe Commerce has been identified with an incorrect authorization vulnerability that allows attackers to bypass security mechanisms. This issue grants unauthorized read access to sensitive information without requiring user interaction. It is critical for users of the affected versions to implement the necessary security updates to mitigate potential risks.

Affected Version(s)

Adobe Commerce 0 <= 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15

References

https://helpx.adobe.com/security/products/magento/apsb25-...
vendor-advisory

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-54265 : Incorrect Authorization Vulnerability in Adobe Commerce Products