Description
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability because admin controllers' _isAllowed() checks fall back to, or only check, parent ACL resources instead of finer per-action permissions. Authenticated restricted administrators can mass cancel or hold orders, rewrite order shipping addresses, export customer report data, or create REST roles despite their role denying those permissions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenMage | magento-lts | 0 <20.18.2 | — |
| OpenMage | magento-lts | 21.0.0-beta1 <21.0.0-beta3 | — |
References
- https://github.com/OpenMage/magento-lts/security/advisories/GHSA-wgf8-gh63-gfqf
- https://github.com/OpenMage/magento-lts/commit/37fa46699ea0d3c4301994dc9411b5639b2ffc2f
- https://github.com/OpenMage/magento-lts/commit/b36d00df844ad127b24b481e1d4c2df90b75d559
- https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-incorrect-authorization-in-admin-controllers-acl