CVE-2025-22385

An issue was discovered in Optimizely Configured Commerce before 5.2.2408. For newly created accounts, the Commerce B2B application does not require email confirmation. This medium-severity issue allows the mass creation of accounts. This could affect database storage; also, non-requested storefront accounts can be created on behalf of visitors.

• CWE-862
• CWE-862

• https://support.optimizely.com/hc/en-us/articles/32695419706637-Configured-Commerce-Security-Advisory-COM-2024-05Vendor Advisory

Published

Jan 4, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-22376In Net::OAuth::Client in the Net::OAuth package before 0.29 …5.3
• CVE-2025-22377An issue was discovered in Samsung Mobile Processor, Wearabl…6.5
• CVE-2025-2238The Vikinger theme for WordPress is vulnerable to privilege …8.8
• CVE-2025-22381Aggie 2.6.1 has a Host Header injection vulnerability in the…8.2
• CVE-2025-22383An issue was discovered in Optimizely Configured Commerce be…4.6
• CVE-2025-22384An issue was discovered in Optimizely Configured Commerce be…7.5
• CVE-2025-22386An issue was discovered in Optimizely Configured Commerce be…7.3
• CVE-2025-22387An issue was discovered in Optimizely Configured Commerce be…7.5
• CVE-2025-22388An issue was discovered in Optimizely EPiServer.CMS.Core bef…5.7
• CVE-2025-22389An issue was discovered in Optimizely EPiServer.CMS.Core bef…8
• CVE-2025-2239Generation of Error Message Containing Sensitive Information…5.3
• CVE-2025-22390An issue was discovered in Optimizely EPiServer.CMS.Core bef…7.5