CVE-2026-128052 · Package
NO FIX YET · SEE WHAT TO DO
OpenMage magento-lts has an authorization gap in its template filter: the {{layout}} directive renders any layout handle without the admin/block whitelist that {{block}} enforces. An administrator who can edit email, CMS, widget or newsletter content can use it to render disallowed blocks and disclose limited information.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only installs that run OpenMage magento-lts in the affected ranges and have staff or accounts with rights to edit email, CMS, widget or newsletter content. The flaw needs an administrator-level account, so sites where only trusted admins hold those rights carry less risk. Installs already on the fixed versions are not affected.
Not affected if fixed-version, no-untrusted-content-editors
Who cares magento-lts, openmage, php, self-hosted
composer show magento-lts/magento-lts or the version in your OpenMage install20.19.0 on the 20.x line, or below 21.0.0-beta3 on the 21.0.0-beta line20.19.0 on the 20.x line21.0.0-beta3 on the 21.0.0-beta lineOpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability in the template filter's {{layout}} directive, which renders arbitrary layout handles without enforcing the admin/block whitelist that the {{block}} directive applies. Administrators with rights to edit email, CMS, widget or newsletter content can embed {{layout}} with arbitrary handles to render disallowed blocks and disclose limited information.
This page as .md ·
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.