OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability because admin controllers'…
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability because admin controllers' _isAllowed() checks fall back to, or only check, parent ACL resources instead of finer per-action permissions. Authenticated restricted administrators can mass cancel or hold orders, rewrite order shipping addresses, export customer report data, or create REST roles despite their role denying those permissions.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- OpenMage
- Product
- magento-lts
- CVSS v3.1
- 3.8 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-863
- NVD status
- Received
Why it ranks 15 (Routine)
- No intrinsic risk signals yet; rank reflects source class and recency only.
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-128031 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.