CVE-2026-128031
Received Received - Intake

Incorrect Authorization in OpenMage Magento-LTS Leading to Privilege Escalation

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability because admin controllers' _isAllowed() checks fall back to, or only check, parent ACL resources instead of finer per-action permissions. Authenticated restricted administrators can mass cancel or hold orders, rewrite order shipping addresses, export customer report data, or create REST roles despite their role denying those permissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128031
EUVD
EUVD-2026-125071

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
openmage magento_lts to 20.18.2 (exc)
openmage magento_lts to 21.0.0-beta3 (exc)
openmage magento_lts From 21.0.0-beta1 (inc) to 21.0.0-beta3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenMage magento-lts before versions 20.18.2 and 21.0.0-beta1 to 21.0.0-beta3 has an authorization flaw where admin controllers incorrectly rely on parent ACL resources instead of specific per-action permissions. This allows authenticated restricted administrators to bypass intended restrictions and perform unauthorized actions like mass order cancellations, shipping address changes, customer data exports, or REST role creation despite lacking permissions.

Impact Analysis

If you are an administrator using OpenMage magento-lts with affected versions, unauthorized users with restricted admin roles could exploit this to modify orders, steal customer data, or create unauthorized API access. This could lead to financial losses, data breaches, or compliance violations for your business.

Compliance Impact

This vulnerability could violate GDPR by enabling unauthorized access to customer data exports or HIPAA by allowing unauthorized modifications to order or shipping information. Non-compliance may result in legal penalties, fines, or reputational damage depending on the regulations applicable to your business.

Mitigation Strategies

Update OpenMage magento-lts to version 20.18.2 or later, or 21.0.0-beta3 or later to address the incorrect authorization vulnerability. Ensure admin controllers' _isAllowed() checks enforce per-action permissions rather than relying on parent ACL resources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128031. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...