Incorrect authorization in magento-lts - #VU158626
Published: November 2, 2026
Vulnerability identifier: #VU158626
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to use USPS administrative tools despite lacking the required shipping configuration permission.
The vulnerability exists due to incorrect authorization in the OpenMage system configuration USPS admin tools when handling tool actions without enforcing access to the Shipping Methods section. A remote privileged user can invoke these tools through broader configuration access to perform operations denied by the role's section-specific permission.
Affected software
magento-lts
Remediation
Install security update from vendor's website.
magento-lts - addressed in versions 20.18.2, 20.19.0, 21.0.0 beta3