CVE-2026-128052
OpenMage magento-lts before 20.19.0 Block Whitelist Bypass via {{layout}} Directive
CVSS Score
2.7
EPSS Score
0.0%
EPSS Percentile
0th
OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability in the template filter's {{layout}} directive, which renders arbitrary layout handles without enforcing the admin/block whitelist that the {{block}} directive applies. Administrators with rights to edit email, CMS, widget or newsletter content can embed {{layout}} with arbitrary handles to render disallowed blocks and disclose limited information.
| CWE | CWE-863 |
| Vendor | openmage |
| Product | magento-lts |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for openmage magento-lts
Be the first to know when new low vulnerabilities affecting openmage magento-lts are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
OpenMage / magento-lts
0 < 20.19.0
OpenMage / magento-lts
21.0.0-beta1 < 21.0.0-beta3
References
github.com: https://github.com/OpenMage/magento-lts/security/advisories/GHSA-fqq6-76qg-2r96 github.com: https://github.com/OpenMage/magento-lts/commit/055ccb866c0fadfed2c27e8c0e9ebd10db0199df vulncheck.com: https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.19.0-block-whitelist-bypass-via-layout-directive
Credits
🔍 0x0OZ colinmollenhour