CVE-2026-128031: OpenMage magento-lts before 20.18.2 Incorrect Authorization in Admin Controllers ACL
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability because admin controllers' isAllowed() checks fall back to, or only check, parent ACL resources instead of finer per-action permissions. Authenticated restricted administrators can mass cancel or hold orders, rewrite order shipping addresses, export customer report data, or create REST roles despite their role denying those permissions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.18.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 21.0.0-beta3
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated OpenMage administrator with a restricted role can exploit it. The role must be allowed to access a parent ACL resource while being denied the affected finer-grained action permission.
Which installations are affected?
OpenMage magento-lts versions before 20.18.2 are affected. The 21.0.0 beta line is affected from 21.0.0-beta1 before 21.0.0-beta3.
What actions could an improperly authorized administrator perform?
They may be able to mass-cancel or hold orders, change order shipping addresses, export customer report data, or create REST roles despite those actions being denied by their assigned role.