Incorrect authorization in magento-lts - #VU158615
Published: November 2, 2026
Vulnerability identifier: #VU158615
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to cancel, hold or unhold orders in bulk despite role restrictions denying those actions.
The vulnerability exists due to incorrect authorization in the OpenMage sales order admin controller when checking permissions for mass actions. A remote privileged user can submit mass cancellation, hold or unhold requests authorized against the parent ACL resource rather than the corresponding action permission to modify orders without the required authorization.
Affected software
magento-lts
Remediation
Install security update from vendor's website.
magento-lts - addressed in versions 20.18.2, 20.19.0, 21.0.0 beta3