CVE-2026-128031 · Package
NO FIX YET · SEE WHAT TO DO
OpenMage magento-lts admin controllers check only parent access rules instead of per-action permissions. An authenticated restricted administrator can cancel or hold orders, rewrite shipping addresses, export customer data and create REST roles despite their role denying those actions.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only OpenMage magento-lts installations where admin users hold restricted roles. The flaw needs a valid administrator account, and a role limited to some actions can still reach the actions it should deny. Installations with only full-access administrators have less exposure.
Not affected if no-restricted-admin-roles, unpatched-version-not-in-range
Who cares ecommerce, magento-lts, openmage, self-hosted
20.18.2 and 21.0.0-beta320.18.2 for the 20.x line21.0.0-beta3 for the 21.0.0 beta lineOpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability because admin controllers' _isAllowed() checks fall back to, or only check, parent ACL resources instead of finer per-action permissions. Authenticated restricted administrators can mass cancel or hold orders, rewrite order shipping addresses, export customer report data, or create REST roles despite their role denying those permissions.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.