CVE-2026-128052
LOW
NVD
CVSS Score
2.7
Severity
LOW
Published
Nov 13, 2026
Vendor
unknown
Description
OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability in the template filter's { {layout} } directive, which renders arbitrary layout handles without enforcing the admin/block whitelist that the { {block} } directive applies. Administrators with rights to edit email, CMS, widget or newsletter content can embed { {layout} } with arbitrary handles to render disallowed blocks and disclose limited information.