CVE-2026-128031

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability because admin controllers' isAllowed checks fall back to, or only check, parent ACL resources instead of finer per-action permissions. Authenticated restricted administrators...

EUVD-2026-125071

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability because admin controllers' isAllowed checks fall back to, or only check, parent ACL resources instead of finer per-action permissions. Authenticated restricted administrators...

CVE-2026-128031

The OpenMage magento-lts platform is vulnerable to an incorrect authorization issue in versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 . The root cause is that admin controllers' _isAllowed() checks fall back to, or exclusively check, parent ACL resources instead of enforcing specifi...