CVE-2025-49550
MEDIUMDescription
Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized access. Exploitation of this issue requires user interaction.
Is your site exposed to CVE-2025-49550?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
References
Advisories & Patches
Frequently Asked Questions
What is CVE-2025-49550? +
How severe is CVE-2025-49550? +
What products are affected by CVE-2025-49550? +
How do I check if I'm vulnerable to CVE-2025-49550? +
Related Vulnerabilities
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version …
A SQL injection (CWE-89) and security boundary bypass (CWE-863) vulnerability exists in the prebuilt BigQuery forecasting tool (bigquery-forecast) of googleapis/mcp-toolbox. …
Pelican is a platform for creating data federations. From versions 7.21.0 to before 7.21.5, 7.22.0 to before 7.22.3, 7.23.0 to …
Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, `pages.access/list` and `files.access/list` permissions are not consistently …
An incorrect authorization vulnerability in MISP allows an organization administrator to target site administrator accounts belonging to the same organization …
Data Space Portal is an open-source Software as a Service (SaaS) solution designed to streamline Dataspace management. From version 2.1.1 …