Incorrect authorization in magento-lts - #VU158624
Published: November 2, 2026
Vulnerability identifier: #VU158624
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to access REST attribute administration despite lacking its specific role permission.
The vulnerability exists due to incorrect authorization in the OpenMage REST attribute admin controller when checking the broader API ACL resource instead of the REST attributes resource. A remote privileged user can invoke REST attribute administration functions using broader API access to bypass the role's attribute-specific access restriction.
Affected software
magento-lts
Remediation
Install security update from vendor's website.
magento-lts - addressed in versions 20.18.2, 20.19.0, 21.0.0 beta3