CVE-2025-49549: 
PHP vulnerability analysis and mitigation

Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability identified as CVE-2025-49549. The vulnerability was discovered and reported by Adobe Systems Incorporated, with the initial CVE record being created and published to the NVD on June 25, 2025 (NVD).

The vulnerability is classified as an Incorrect Authorization issue (CWE-863) that could result in a security feature bypass. According to the CVSS 3.1 scoring, it has received a Base Score of 2.7 (LOW) with the following vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. This indicates that the vulnerability is network accessible, requires high privileges, but no user interaction for exploitation (NVD, Wiz).

If exploited, this vulnerability could allow a high-privileged attacker to bypass security measures and gain limited unauthorized access to the system. The impact is primarily focused on confidentiality with low severity, while integrity and availability are not affected according to the CVSS scoring (Wiz).

Adobe has addressed this vulnerability in their security bulletin APSB25-50. Users are advised to update to the latest version of Adobe Commerce to mitigate this security issue (Adobe Security).