GHSA-39rw-4m66-82gf
Magento incorrect user permissions vulnerability within the Inventory component
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | magento/community-edition | < 2.3.6 | 2.3.6 |
| Packagist | magento/community-edition | >= 2.4.0, < 2.4.1 | 2.4.1 |
| Packagist | magento/project-community-edition | <= 2.0.2 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect user permissions vulnerability within the Inventory component. This vulnerability could be abused by authenticated users with Inventory and Source permissions to make unauthorized changes to inventory source data via the REST API.
References
External links from the advisory. They lead to third-party sites.