Incorrect authorization in magento-lts - #VU158623
Published: November 2, 2026
Vulnerability identifier: #VU158623
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to create, edit or delete REST roles despite role restrictions denying those actions.
The vulnerability exists due to incorrect authorization in the OpenMage REST role admin controller when handling role-management actions without enforcing their individual permissions. A remote privileged user can invoke creation, editing or deletion functions through broader ACL access to make unauthorized REST role changes, including creating and self-assigning a role with only the Delete permission.
Affected software
magento-lts
Remediation
Install security update from vendor's website.
magento-lts - addressed in versions 20.18.2, 20.19.0, 21.0.0 beta3