CVE-2021-21026 in Magento and Adobe Products
Published on February 11, 2021

Magento Commerce Incorrect permissions Could Lead To Unauthorized Access

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by an improper authorization vulnerability in the integrations module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is required for successful exploitation.

NVD

Weakness Type

What is an AuthZ Vulnerability?

The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

CVE-2021-21026 has been classified to as an AuthZ vulnerability or weakness.

Products Associated with CVE-2021-21026

stack.watch emails you whenever new vulnerabilities are published in Magento or Adobe Magento Commerce. Just hit a watch button to start following.

Magento

Adobe Magento Commerce

Affected Versions

Adobe Magento Commerce:

Version unspecified, <= 2.4.1 is affected.
Version unspecified, <= 2.4.0-p1 is affected.
Version unspecified, <= 2.3.6 is affected.
Version unspecified, <= None is affected.

Exploit Probability

EPSS

0.68%

Percentile

71.25%