GHSA-56r4-wc4h-fr54MediumCVSS 2.7
OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect...
🔗 CVE IDs covered (1)
📋 Description
OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability in the template filter's {{layout}} directive, which renders arbitrary layout handles without enforcing the admin/block whitelist that the {{block}} directive applies. Administrators with rights to edit email, CMS, widget or newsletter content can embed {{layout}} with arbitrary handles to render disallowed blocks and disclose limited information.
🔗 References (5)
- https://github.com/OpenMage/magento-lts/security/advisories/GHSA-fqq6-76qg-2r96
- https://nvd.nist.gov/vuln/detail/CVE-2026-128052
- https://github.com/OpenMage/magento-lts/commit/055ccb866c0fadfed2c27e8c0e9ebd10db0199df
- https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.19.0-block-whitelist-bypass-via-layout-directive
- https://github.com/advisories/GHSA-56r4-wc4h-fr54