Magento allows incorrect authorization
Date: 2025-10
Affected: composer/magento/project-community-edition, composer/magento/community-edition, composer/magento/community-edition
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2025-54263
CVE-2025-54264
CVE-2025-54265
CVE-2025-54266
CVE-2025-54267
CWE: CWE-79
CWE-863
CVSS: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Magento versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction.


Mitigations:

Architectural layers (MAESTRO):