GHSA-7hrj-3c9x-xv5hHighCVSS 7.5

Magento has incorrect authorization issue that leads to arbitrary file system read

Published
August 12, 2025
Last Modified
October 21, 2025

🔗 CVE IDs covered (1)

CVE-2025-49556 →

📋 Description

Magento versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction, and scope is unchanged.

🎯 Affected products10

  • composer/magento/project-community-edition:<= 2.0.2
  • composer/magento/community-edition:>= 2.4.9-alpha1, < 2.4.9-alpha2
  • composer/magento/community-edition:>= 2.4.8-beta1, < 2.4.8-p2
  • composer/magento/community-edition:>= 2.4.7-beta1, < 2.4.7-p7
  • composer/magento/community-edition:>= 2.4.6-p1, < 2.4.6-p12
  • composer/magento/community-edition:< 2.4.5-p14
  • composer/magento/community-edition:= 2.4.5
  • composer/magento/community-edition:= 2.4.6
  • composer/magento/community-edition:= 2.4.7
  • composer/magento/community-edition:= 2.4.8

🔗 References (3)