Magento provides incorrect authorization through a security feature bypass

高 8.1CVE-2025-54263 · GHSA-69x9-xp2j-w8g8 · 14/10/2025 公開 · 08/10/2026 更新

要点

CVE-2025-54263 は magento/community-edition, magento/project-community-edition, commerce (adobe) に影響する深刻度「高」 (CVSS 8.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.60%（全脆弱性の 48.7% より高い）。
対処：2.4.7-p8, 2.4.8-p3, 2.4.9-alpha3, 2.4.6-p13 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
magento/community-edition Packagist	`= 2.4.6= 2.4.7= 2.4.8≥ 2.4.7-beta1, < 2.4.7-p8≥ 2.4.8-beta1, < 2.4.8-p3≥ 2.4.9-alpha1, < 2.4.9-alpha3< 2.4.6-p13`	`2.4.7-p82.4.8-p32.4.9-alpha32.4.6-p13`
magento/project-community-edition Packagist	`≤ 2.0.2`	修正版なし
commerce adobe	`= 2.4.4= 2.4.5= 2.4.6= 2.4.7= 2.4.8= 2.4.9`	修正版なし
commerce b2b adobe	`= 1.3.3= 1.3.4= 1.3.5= 1.4.2= 1.5.2= 1.5.3`	修正版なし
magento adobe	`= 2.4.6= 2.4.7= 2.4.8= 2.4.9`	修正版なし

概要

Magento versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. A low-privileged attacker could leverage this vulnerability to bypass security measures and maintain unauthorized access. Exploitation of this issue does not require user interaction.

NVD の説明

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. A low-privileged attacker could leverage this vulnerability to bypass security measures and maintain unauthorized access. Exploitation of this issue does not require user interaction.