CVE-2025-49556highCWE-863

CVE-2025-49556: fallo de gravedad alta en Adobe Commerce

Adobe Commerce | Incorrect Authorization (CWE-863)

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Adobe Commerce+ Monitorear magento/community-edition

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 0.7%
Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction, and scope is unchanged.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
Adobe · Adobe Commerce
CVEs relacionadas — Adobe Commerce

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-34102CRITICALXXE can expose crypt key and other secrets granting full admin accessEPSS 100.0%KEVCVE-2026-75650CRITICALAdobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)EPSS 99.4%KEVCVE-2025-54236CRITICALAdobe Commerce | Improper Input Validation (CWE-20)EPSS 95.5%KEVCVE-2026-71362CRITICALAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 91.7%KEVCVE-2026-48356CRITICALAdobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)EPSS 47.5%CVE-2026-34648HIGHAdobe Commerce | Uncontrolled Resource Consumption (CWE-400)EPSS 21.4%