Incorrect authorization in magento-lts - #VU158621
Published: November 2, 2026
Vulnerability identifier: #VU158621
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to access restricted report data, including customer names, email addresses and IP addresses.
The vulnerability exists due to incorrect authorization in the OpenMage report admin controllers when handling exports and detail pages without enforcing each report's specific permission. A remote privileged user can request restricted report exports or detail pages using broader module access to disclose data denied by the role's finer permissions.
Affected software
magento-lts
Remediation
Install security update from vendor's website.
magento-lts - addressed in versions 20.18.2, 20.19.0, 21.0.0 beta3