Vulnerability advisory
BIT-magento-2020-24401
Incorrect permissions following the deletion of a user role or deactivation of a user
Also known as CVE-2020-24401GHSA-f2g3-3c6q-4478
Severity
Severity not reported.
Affected versions
magento Bitnami
| Affected | Fixed in |
|---|---|
| All versions before 2.3.5 | 2.3.5 |
2.4.0 to before 2.4.1 | 2.4.1 |
Severity for this package
| |
Description
Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect authorization vulnerability. A user can still access resources provisioned under their old role after an administrator removes the role or disables the user's account.