Description
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 lets restricted administrators read decrypted configuration secrets because the store.getConfig email template directive's encrypted-path check missed config.xml-declared paths, case variants of the getConfig method name, and parent paths. Administrators with Transactional Emails access can preview a crafted template to expose PayPal, payment gateway, and carrier credentials.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenMage | magento-lts | 0 <20.18.2 | — |
| OpenMage | magento-lts | 21.0.0-beta1 <21.0.0-beta3 | — |