Adobe Commerce APSB25-50: authorization gaps and CSRF in the April 2025 patch

What happened

On 8 April 2025, Adobe released APSB25-50, a priority-2 security update for Adobe Commerce and Magento Open Source. The NVD entries landed the same day: CVE-2025-27188 (improper authorization), CVE-2025-27189 (CSRF), CVE-2025-27190 and CVE-2025-27191 (improper access control), and CVE-2025-27192 (insufficiently protected credentials).

Affected lines were 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, and 2.4.8-beta2 and earlier — in practice, nearly every supported store.

Impact

Improper authorization plus access-control gaps is the combination that leaks other customers' data: order histories, saved addresses, B2B quote details. The CSRF issue lets an attacker ride an admin's live session to perform state-changing actions. None of these is a single-click RCE, but together they widen every targeted attack against a store.

Root cause in one paragraph

Several admin and storefront controllers checked that the caller was logged in without checking that the caller was allowed to touch the specific object — the resource-vs-route authorization gap — while one state-changing endpoint missed CSRF token validation, letting a malicious page forge requests in an admin's browser.

What to do now

• Upgrade to 2.4.7-p5 / 2.4.6-p10 / 2.4.5-p12 / 2.4.4-p13 (or the isolated patch if you cannot take the full release yet).
• Follow the standard Commerce upgrade path: composer update in staging, setup:upgrade, regression pass on checkout and admin grids, then production deploy in maintenance window.
• Review custom modules that override the affected controllers — an override can silently reintroduce the unpatched behavior.
• Rotate admin credentials and integration tokens as hygiene after any access-control fix.
• Confirm your WAF/virtual-patching rules (Fastly, Cloudflare) cover the disclosed paths while straggler environments catch up.

What this means for Magento stores

This is your own platform's patch, not someone else's cautionary tale: the fix is a version bump you control. The deeper lesson is the override audit — most long-lived Magento stores carry controller preferences and plugins that bypass core authorization checks. Every Adobe security release is a prompt to re-verify those customizations, not just to run composer.

Sources

• Adobe: APSB25-50
• NVD: CVE-2025-27188, CVE-2025-27189, CVE-2025-27192

Next in this series: React Server Components RCE (CVE-2025-55182) — /blog/cve-2025-react-rsc-55182