Incorrect authorization in magento-lts - #VU158622
Published: November 2, 2026
Vulnerability identifier: #VU158622
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to access, edit or delete catalog tags despite role restrictions denying those operations.
The vulnerability exists due to incorrect authorization in the OpenMage catalog tag admin controller when handling the All Tags grid, edits and mass actions without enforcing the appropriate tag permission. A remote privileged user can invoke these functions through broader module access to view or modify tags outside the role's permitted scope.
Affected software
magento-lts
Remediation
Install security update from vendor's website.
magento-lts - addressed in versions 20.18.2, 20.19.0, 21.0.0 beta3