CVE-2026-128031

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability because admin controllers' isAllowed checks fall back to, or only check, parent ACL resources instead of finer per-action permissions. Authenticated restricted administrators...

EUVD-2026-125071

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability because admin controllers' isAllowed checks fall back to, or only check, parent ACL resources instead of finer per-action permissions. Authenticated restricted administrators...

CVE-2026-128031 OpenMage magento-lts before 20.18.2 Incorrect Authorization in Admin Controllers ACL

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability because admin controllers' isAllowed checks fall back to, or only check, parent ACL resources instead of finer per-action permissions. Authenticated restricted administrators...