What is the CVSS score of CVE-2025-54265?

CVE-2025-54265 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2025-54265?

Yes, a patch is available for CVE-2025-54265. Update the affected software to the latest version immediately.

Adobe Commerce CVE-2025-54265

MEDIUM

Incorrect Authorization (CWE-863)

2025-10-14 psirt@adobe.com

Authentication Bypass Adobe

5.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 28, 2026 - 03:30 vuln.today

DescriptionCVE.org

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

AnalysisAI

Adobe Commerce versions 2.4.9-alpha2 through 2.4.4-p15 are vulnerable to an incorrect authorization flaw that allows remote, unauthenticated attackers to bypass security controls and gain unauthorized read access to sensitive data. The vulnerability requires specific conditions beyond the attacker's control and does not require user interaction, but carries a moderate CVSS score of 5.9 reflecting high confidentiality impact and high attack complexity.

Technical ContextAI

This vulnerability (CWE-863: Incorrect Authorization) stems from inadequate access control checks within Adobe Commerce application logic. The CVSS vector indicates network-accessible attack surface with no authentication required, but high attack complexity suggests the exploit depends on specific environmental conditions, application state, or timing factors rather than a straightforward network request. The vulnerability affects multiple maintenance and patch release branches spanning versions 2.4.4 through 2.4.9-alpha2, indicating a systemic authorization control issue rather than a recent regression. CPE data confirms the vulnerability exists across all patch levels of Adobe Commerce 2.4.4 (baseline through p15) and likely extends to earlier and later major versions as documented in the advisory.

RemediationAI

Upgrade to patched versions as specified in Adobe security advisory APSB25-94 (https://helpx.adobe.com/security/products/magento/apsb25-94.html). Organizations unable to patch immediately should implement network-level access controls to restrict access to Adobe Commerce administrative interfaces and sensitive API endpoints to trusted internal networks only. Application-level mitigation may include reviewing and strengthening role-based access control (RBAC) configurations within Commerce Admin to ensure authorization rules are explicitly enforced. Monitor access logs for unusual read patterns or requests targeting sensitive data endpoints, particularly from unauthenticated sources or unexpected geographic locations. If the vulnerability depends on specific application features or configuration options (as suggested by AC:H), consult the advisory to determine if temporarily disabling those features until patching is possible is operationally acceptable.