CVE-2025-49550: 
PHP vulnerability analysis and mitigation

Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability (CVE-2025-49550). The vulnerability was disclosed on June 25, 2025, and has been classified as a security feature bypass issue. This vulnerability could potentially compromise system security through unauthorized access, though exploitation requires user interaction (NVD).

The vulnerability has been classified with a CVSS v3.1 Base Score of 4.3 (MEDIUM) with the vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. The weakness has been categorized as CWE-863 (Incorrect Authorization). The technical assessment indicates that while the vulnerability requires user interaction, it has network accessibility with low attack complexity (NVD, Wiz).

If successfully exploited, this vulnerability could allow an attacker to bypass security measures and gain limited unauthorized access to the system. The vulnerability specifically impacts the confidentiality of the system, with a low severity rating for data exposure (Wiz).

Adobe has released security updates for affected versions of Adobe Commerce. Users are advised to update to the latest version of the software to mitigate this vulnerability (Adobe Security).