Threats tagged 'ghsa-xq8q-45hh-5rfm'

OpenMage magento-lts versions prior to 20.18.2 and 21.0.0-beta3 contain an authorization vulnerability where admin controllers improperly check permissions. This flaw allows authenticated restricted administrators to perform unauthorized actions such as mass canceling or holding orders, modifying order shipping addresses, exporting customer report data, or creating REST roles despite lacking explicit permissions.