OpenMage magento-lts before 20.19.0 Block Whitelist Bypass via {{layout}} Directive
CVE-2026-128052

5.1MEDIUM

Key Information:

Vendor

Openmage

Status
Magento-lts
Vendor
CVE Published:
13 November 2026

What is CVE-2026-128052?

OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability in the template filter's {{layout}} directive, which renders arbitrary layout handles without enforcing the admin/block whitelist that the {{block}} directive applies. Administrators with rights to edit email, CMS, widget or newsletter content can embed {{layout}} with arbitrary handles to render disallowed blocks and disclose limited information.

Affected Version(s)

magento-lts 0 < 20.19.0

magento-lts 21.0.0-beta1 < 21.0.0-beta3

magento-lts 20.19.0

References

https://github.com/OpenMage/magento-lts/security/advisori...
vendor-advisory
https://github.com/OpenMage/magento-lts/commit/055ccb866c...
patch
https://www.vulncheck.com/advisories/openmage-magento-lts...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

0x0OZ
colinmollenhour
.