High

Incorrect Authorization in Adobe Commerce and Magento Open Source

IdentifiersCVE-2025-54263CWE-863· Incorrect Authorization

CVE-2025-54263 is a critical incorrect authorization / improper access control vulnerability affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. Affected versions include Adobe Commerce 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier; Adobe Commerce B2B 1.5.3-alpha2, 1.5.2-p2, 1.4.2-p7, 1.3.5-p12, 1.3.4-p14, 1.3.3-p15 and earlier; and corresponding Magento Open Source releases. The flaw is in authorization logic: authenticated low-privileged users can bypass intended security restrictions because authorization checks are missing or incorrectly implemented. Public technical details such as specific vulnerable endpoints, functions, or code paths have not been disclosed. The issue is remotely exploitable over the network, affects both web and API interfaces, and does not require user interaction.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an authenticated low-privileged attacker to bypass security controls and access resources or perform actions intended only for higher-privileged roles. This can result in unauthorized access within the application and effective privilege escalation. Available reporting indicates high confidentiality and integrity impact, though no availability impact has been specifically noted.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, reduce exposure by restricting administrative and management interface access, limiting API exposure where feasible, enforcing least privilege for all authenticated accounts, disabling unnecessary features or modules, and closely monitoring for suspicious account activity or unauthorized access attempts. These measures are temporary risk-reduction steps and do not replace vendor patching.

Remediation

Patch, then assume compromise.

Apply Adobe's security updates referenced in APSB25-94 and upgrade to the vendor-fixed releases for Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. At minimum, organizations should move off the affected versions listed in the advisory and deploy the corresponding patched release for their branch immediately.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

AdobeAdobe Commerceapplication

AdobeAdobe Commerce B2bapplication

AdobeCommerceapplication

AdobeCommerce B2bapplication

AdobeMagentoapplication

AdobeMagento Open Sourceapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

thecyberexpress com vulnerabilitiesNews

Oct 15, 2025

Adobe Issues Urgent Security Updates for Connect, Commerce, and Creative Cloud Apps

A critical improper access control vulnerability in Adobe Commerce and Magento Open Source that could enable privilege escalation or authentication bypass.

adobe-security-bulletinsNews

Oct 14, 2025

Adobe Security Bulletin

An incorrect authorization flaw in Adobe Commerce / Magento Open Source that can allow a security feature bypass under certain authenticated conditions.

zeropath blogNews

Oct 14, 2025

Adobe Commerce CVE-2025-54263: Brief Summary of Improper Access Control Vulnerability - ZeroPath Blog | ZeroPath

An improper access control vulnerability in Adobe Commerce and Magento Open Source that allows low-privileged authenticated users to bypass authorization checks and access restricted resources or perform higher-privileged actions.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity