CVE-2026-128052: OpenMage magento-lts before 20.19.0 Block Whitelist Bypass via {{layout}} Directive
OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability in the template filter's {{layout}} directive, which renders arbitrary layout handles without enforcing the admin/block whitelist that the {{block}} directive applies. Administrators with rights to edit email, CMS, widget or newsletter content can embed {{layout}} with arbitrary handles to render disallowed blocks and disclose limited information.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Affected versions are OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 through before 21.0.0-beta3. The issue is relevant where administrators can edit email, CMS, widget, or newsletter content.
What access does an attacker need to exploit this?
An attacker needs administrator-level rights that permit editing template-filtered email, CMS, widget, or newsletter content. No user interaction is required after the malicious content is saved and rendered.
What is the practical impact?
A permitted administrator can use the {{layout}} directive with arbitrary layout handles to render blocks that would be disallowed by the admin/block whitelist. The stated impact is disclosure of limited information; integrity and availability impact are not indicated.
How can teams check for possible exploitation?
Review editable email, CMS, widget, and newsletter content for use of the {{layout}} directive, particularly directives referencing unexpected or sensitive layout handles. Also identify accounts with rights to edit this content, since those permissions are required for exploitation.
What can be done before upgrading?
Restrict administrator permissions to edit email, CMS, widget, and newsletter content to trusted users, and review existing content for {{layout}} directives with unapproved handles. Upgrade affected 20.x installations to 20.19.0 or later, and affected 21.0.0 beta installations to 21.0.0-beta3 or later.