CVE-2026-128052

CVSS 5.1 (medium) · published 2026-11-13

OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability in the template filter's {{layout}} directive, which renders arbitrary layout handles without enforcing the admin/block whitelist that the {{block}} directive applies. Administrators with rights to edit email, CMS, widget or newsletter content can embed {{layout}} with arbitrary handles to render disallowed blocks and disclose limited information.

Weakness: CWE-863

Source: NVD CVE-2026-128052

References

• https://github.com/OpenMage/magento-lts/commit/055ccb866c0fadfed2c27e8c0e9ebd10db0199df
• https://github.com/OpenMage/magento-lts/security/advisories/GHSA-fqq6-76qg-2r96
• https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.19.0-block-whitelist-bypass-via-layout-directive

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.