Adobe Commerce CVE-2025-54263

Exploitation requires the attacker to already possess a valid low-privileged authenticated account on the target Adobe Commerce/Magento store (PR:L) - for example a customer account or a restricted B2B company/portal user - since the flaw is an incorrect authorization check (CWE-863) rather than a fully unauthenticated bypass. No user interaction and no special client-side action is needed (UI:N). The limiting factor is therefore the need to obtain or register that low-privileged account; stores that allow self-registration lower this barrier significantly, while those restricting account creation raise it. The specific feature or endpoint with the faulty authorization logic is not disclosed in the provided description, so defenders should treat any authenticated role boundary as potentially affected until the patch (APSB25-94) is applied.

This is a moderately serious issue but not a top-tier emergency based on current signals. The CVSS 3.1 base score of 8.1 (High) is driven by AV:N/AC:L/PR:L/UI:N with high confidentiality and integrity impact (C:H/I:H) and no availability impact (A:N) - meaning a network-reachable, low-complexity authorization bypass requiring only low privileges and no user interaction. Crucially, the CVSS vector and the description are consistent: PR:L aligns with the description's 'low-privileged attacker,' so there is no network-vs-local or auth conflict to flag. However, the real-world exploitation signals are relatively low: EPSS is only 0.60% (47th percentile), the CVE is NOT on the CISA KEV list, and no public exploit code or SSVC decision data was provided. The combination of high severity but low EPSS and no KEV/POC suggests this is a patch-promptly-but-not-drop-everything issue: the impact if exploited is significant (data exposure and unauthorized state changes), but there is no evidence of active or imminent widespread exploitation at the time of analysis. SSVC/automatable data was not supplied and cannot be assessed.

An attacker who already holds a low-privileged account on an Adobe Commerce store (for example a registered customer or a limited B2B company user) sends crafted requests that the application fails to authorize correctly, bypassing access controls to reach data or functions reserved for higher-privileged users. Because no user interaction is required, the attacker can automate the requests once authenticated. No public proof-of-concept exploit was identified in the provided data.