Incorrect authorization in magento-lts - #VU158628
Published: November 2, 2026
Vulnerability identifier: #VU158628
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to import or export tax rates without the required role permission.
The vulnerability exists due to incorrect authorization in the OpenMage tax rate import and export actions when handling requests without enforcing the dedicated tax-rate import/export permission. A remote privileged user can invoke these actions through broader tax administration access to read or change tax-rate data despite the role's denied permission.
Affected software
magento-lts
Remediation
Install security update from vendor's website.
magento-lts - addressed in versions 20.18.2, 20.19.0, 21.0.0 beta3