CVE-2025-49556: 
PHP vulnerability analysis and mitigation

Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Incorrect Authorization vulnerability identified as CVE-2025-49556. The vulnerability was discovered and disclosed on August 12, 2025, affecting Adobe Commerce and Magento Open Source platforms (NVD).

The vulnerability is classified as an Incorrect Authorization issue (CWE-863) that could result in a security feature bypass. The severity is rated as HIGH with a CVSS v3.1 base score of 7.5 (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The vulnerability is characterized by network attack vector, low attack complexity, and requires no privileges or user interaction (NVD).

An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access to the system. The scope of the vulnerability remains unchanged, affecting the confidentiality of the system while integrity and availability remain unaffected (NVD).

Adobe has released security updates to address this vulnerability. Users are advised to update their Adobe Commerce and Magento Open Source installations to the latest patched versions (Adobe Advisory).