Adobe Commerce CVE-2025-54267

Requires a valid low-privileged authenticated account on the Adobe Commerce/Magento instance (CVSS PR:L; the description explicitly says 'a low-privileged attacker'), after which the attacker exploits an incorrect-authorization flaw (CWE-863) to escalate to elevated privileges. No special non-default feature is named in the advisory, and no user interaction is required (UI:N), so any instance exposing authenticated low-privilege access (customer, limited admin, API, or B2B company user - note the 'Commerce B2b' tag) to network-reachable endpoints is potentially affected. The key limiting factor is that this is NOT a pre-authentication flaw: the attacker must first possess some authenticated foothold, which reduces exposure for stores that tightly restrict account provisioning. Affected versions are 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier; upgrading to the patched release removes the condition.

This is a genuine but moderate-priority issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N = 6.5 Medium) describes a network-reachable, low-complexity privilege-escalation flaw that an attacker can trigger with only low privileges and no user interaction, but with impact limited to integrity (C:N/A:N) - meaning it corrupts/elevates authorization state rather than leaking data or causing outages. The intelligence signals are consistent and point to lower real-world urgency: EPSS is 0.43% (35th percentile), indicating low near-term exploitation probability; the CVE is NOT on the CISA KEV list; and no public PoC was provided - so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision was supplied. There is no conflict between signals here (low EPSS, no KEV, no PoC, Medium CVSS all align), so this is a patch-in-normal-cycle item, not a drop-everything issue. One caveat to verify: the input tag labels this an 'Authentication Bypass,' but the CWE-863 (Incorrect Authorization) and the description ('low-privileged attacker ... gain unauthorized access to elevated privileges') describe privilege escalation / authorization bypass by an already-authenticated low-privileged user, not pre-auth authentication bypass - defenders should treat the PR:L (authenticated) requirement as the operative gating factor.

An attacker who already holds a low-privileged account on the Adobe Commerce/Magento store (for example a limited admin, API user, or B2B company account) sends crafted requests to an improperly authorized endpoint and obtains elevated privileges they should not have. No end-user interaction is required (UI:N), and the result is a high-integrity impact such as modifying data or configuration reserved for higher-privileged roles. No public exploit code was identified at time of analysis.