OpenMage magento-lts before 20.18.2 Incorrect Authorization in Admin Controllers ACL
CVE-2026-128031

5.1MEDIUM

Key Information:

Vendor

Openmage

Status
Magento-lts
Vendor
CVE Published:
13 November 2026

What is CVE-2026-128031?

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability because admin controllers' _isAllowed() checks fall back to, or only check, parent ACL resources instead of finer per-action permissions. Authenticated restricted administrators can mass cancel or hold orders, rewrite order shipping addresses, export customer report data, or create REST roles despite their role denying those permissions.

Affected Version(s)

magento-lts 0 < 20.18.2

magento-lts 21.0.0-beta1 < 21.0.0-beta3

magento-lts 20.18.2

References

https://github.com/OpenMage/magento-lts/security/advisori...
vendor-advisory
https://github.com/OpenMage/magento-lts/commit/37fa46699e...
patch
https://github.com/OpenMage/magento-lts/commit/b36d00df84...
patch

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

colinmollenhour
.