CVE-2025-54263CWE-863broken-access-control

CVE-2025-54263

High Β· published October 15, 2025

CVSS v3.1
8.1
EPSS
1%
Percentile
48.0
In the wild
Unconfirmed
What it is

⚑ A low-privileged attacker could sneak past security like a kid slipping into a movie theater without a ticket! 🎟️ Picture a bouncer who’s supposed to check IDs but gets distracted by a phone call. Suddenly, anyone can waltz in, and that’s exactly what’s happening here with this Adobe Commerce vulnerability! An attacker can bypass security protocols and gain unauthorized access to sensitive areas of your Adobe Commerce site. This means they could potentially view, modify, or even delete crucial data without breaking a sweat! This kind of breach could lead to stolen customer information or altered transactions, which is absolutely devastating for any online business.

Put simply

Picture a bouncer who’s supposed to check IDs but gets distracted by a phone call. Suddenly, anyone can waltz in, and that’s exactly what’s happening here with this Adobe Commerce vulnerability! This Incorrect Authorization vulnerability allows low-privileged attackers to exploit flaws in user role checks, enabling them to access data they're not permitted to view or modify. The flaw exists in Adobe Commerce versions 2.4.9-alpha2 and earlier, allowing exploitation without any user interaction.

What to do

An attacker can bypass security protocols and gain unauthorized access to sensitive areas of your Adobe Commerce site. This means they could potentially view, modify, or even delete crucial data without breaking a sweat! This kind of breach could lead to stolen customer information or altered transactions, which is absolutely devastating for any online business. Immediately upgrade to Adobe Commerce version 2.4.9 or later to patch this vulnerability. Also, review your user roles and permissions to ensure they are set correctly and monitor access logs for any unusual activity. Taking these steps will help keep your application secure! You've got this! With these actions, you can fortify your defenses and protect your online store. πŸ›‘οΈ

The record
Technical detail
CVSS v3.1
8.1 Β· HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00599 Β· 48.0th percentile
Weakness
CWE-863 Β· Incorrect Authorization
Published
2025-10-15T01:15Z
Affected products (150)
ProductVersionsFixed in
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerceall versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/commerce_b2ball versionsβ€”
adobe/magentoall versionsβ€”
adobe/magentoall versionsβ€”
adobe/magentoall versionsβ€”
adobe/magentoall versionsβ€”
adobe/magentoall versionsβ€”
adobe/magentoall versionsβ€”
adobe/magentoall versionsβ€”
adobe/magentoall versionsβ€”
adobe/magentoall versionsβ€”
adobe/magentoall versionsβ€”
adobe/magentoall versionsβ€”
adobe/magentoall versionsβ€”
adobe/magentoall versionsβ€”
adobe/magentoall versionsβ€”
adobe/magentoall versionsβ€”
adobe/magentoall versionsβ€”
adobe/magentoall versionsβ€”
adobe/magentoall versionsβ€”
adobe/magentoall versionsβ€”
adobe/magentoall versionsβ€”
adobe/magentoall versionsβ€”
adobe/magentoall versionsβ€”
adobe/magentoall versionsβ€”
adobe/magentoall versionsβ€”
adobe/magentoall versionsβ€”
adobe/magentoall versionsβ€”
adobe/magentoall versionsβ€”
adobe/magentoall versionsβ€”
adobe/magentoall versionsβ€”
adobe/magentoall versionsβ€”
adobe/magentoall versionsβ€”
References (1)
EPSS history
Timeline
  • 14 OCT 20:27Z
    Adobe Commerce | Incorrect Authorization (CWE-863)
    cvelistv5