CVE-2025-24429
Adobe Commerce | Improper Access Control (CWE-284)
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass allowing read only access. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue requires user interaction.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Adobe Commerce | Improper Access Control (CWE-284)
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass allowing read only access. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue requires user interaction.
- Record
CVE-2025-24429- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2025-3710
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass allowing read only access. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue requires user interaction.
- Record
EUVD-2025-3710- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-656q-fx2w-8ccv
Magento Improper Access Control vulnerability
Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.
- Record
GHSA-656q-fx2w-8ccv- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
NVD
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass allowing read only access. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue requires user interaction.
- Record
CVE-2025-24429- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
Adobe Commerce | Improper Access Control (CWE-284)
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass allowing read only access. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue requires user interaction.
- Record
CVE-2025-24429- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGHSA-656q-fx2w-8ccv
Magento Improper Access Control vulnerability
Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.
- Record
GHSA-656q-fx2w-8ccv- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
magento/community-editionPackagist | 2.4.7-beta1 up to 2.4.7-p4 | 2.4.7-p4 |
magento/community-editionPackagist | 2.4.6-p1 up to 2.4.6-p9 | 2.4.6-p9 |
magento/community-editionPackagist | 2.4.5-p1 up to 2.4.5-p11 | 2.4.5-p11 |
magento/community-editionPackagist | before 2.4.4-p12 | 2.4.4-p12 |
magento/community-editionPackagist | 2.4.7 to 2.4.7 | None known |
magento/community-editionPackagist | 2.4.6 to 2.4.6 | None known |
magento/community-editionPackagist | 2.4.5 to 2.4.5 | None known |
magento/community-editionPackagist | 2.4.4 to 2.4.4 | None known |
magento/community-editionPackagist | 2.4.8-beta1 to 2.4.8-beta1 | None known |
magento/project-community-editionPackagist | through 2.0.2 | None known |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
magento/community-editionPackagist | 2.4.7-beta1 up to 2.4.7-p4, plus listed versions 2.4.72.4.7-beta22.4.7-beta32.4.7-p12.4.7-p22.4.7-p3 | 2.4.7-p4 |
magento/community-editionPackagist | 2.4.6-p1 up to 2.4.6-p9, plus listed versions 2.4.6-p22.4.6-p32.4.6-p42.4.6-p52.4.6-p62.4.6-p72.4.6-p8 | 2.4.6-p9 |
magento/community-editionPackagist | 2.4.5-p1 up to 2.4.5-p11, plus listed versions 2.4.5-p102.4.5-p22.4.5-p32.4.5-p42.4.5-p5 Show 4 moreShow less2.4.5-p62.4.5-p72.4.5-p82.4.5-p9 | 2.4.5-p11 |
magento/community-editionPackagist | before 2.4.4-p12, plus listed versions 0.1.0-alpha1000.1.0-alpha1010.1.0-alpha1020.1.0-alpha1030.1.0-alpha104 Show 45 moreShow less0.1.0-alpha1050.1.0-alpha1060.1.0-alpha1070.1.0-alpha1080.1.0-alpha890.1.0-alpha900.1.0-alpha910.1.0-alpha920.1.0-alpha930.1.0-alpha940.1.0-alpha950.1.0-alpha960.1.0-alpha970.1.0-alpha980.1.0-alpha990.42.0-beta10.42.0-beta100.42.0-beta110.42.0-beta20.42.0-beta30.42.0-beta40.42.0-beta50.42.0-beta60.42.0-beta70.42.0-beta80.42.0-beta90.74.0-beta10.74.0-beta100.74.0-beta110.74.0-beta120.74.0-beta130.74.0-beta140.74.0-beta150.74.0-beta160.74.0-beta20.74.0-beta30.74.0-beta40.74.0-beta50.74.0-beta60.74.0-beta70.74.0-beta80.74.0-beta91.0.0-beta1.0.0-beta21.0.0-beta3 | 2.4.4-p12 |
magento/community-editionPackagist | Listed versions 2.4.7 | None known |
magento/community-editionPackagist | Listed versions 2.4.6 | None known |
magento/community-editionPackagist | Listed versions 2.4.5 | None known |
magento/community-editionPackagist | Listed versions 2.4.4 | None known |
magento/community-editionPackagist | Listed versions 2.4.8-beta1 | None known |
magento/project-community-editionPackagist | through 2.0.2, plus listed versions 0.1.0-alpha1000.1.0-alpha1010.1.0-alpha1020.1.0-alpha1030.1.0-alpha104 Show 45 moreShow less0.1.0-alpha1050.1.0-alpha1060.1.0-alpha1070.1.0-alpha1080.1.0-alpha890.1.0-alpha900.1.0-alpha910.1.0-alpha920.1.0-alpha930.1.0-alpha940.1.0-alpha950.1.0-alpha960.1.0-alpha970.1.0-alpha980.1.0-alpha990.42.0-beta10.42.0-beta100.42.0-beta110.42.0-beta20.42.0-beta30.42.0-beta40.42.0-beta50.42.0-beta60.42.0-beta70.42.0-beta80.42.0-beta90.74.0-beta10.74.0-beta100.74.0-beta110.74.0-beta120.74.0-beta130.74.0-beta140.74.0-beta150.74.0-beta160.74.0-beta20.74.0-beta30.74.0-beta40.74.0-beta50.74.0-beta60.74.0-beta70.74.0-beta80.74.0-beta91.0.0-beta2.0.02.0.0-rc | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-24429 is a low vulnerability (CVSS 3.5) in Adobe Commerce, published February 11, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 43rd percentile. Fixed in magento/community-edition 2.4.7-p4.
References
Left out here: 101 versions. The JSON record has them.