Description
Insufficient enforcement of user access controls in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could enable a low-privileged user to make unauthorized environment configuration changes.
Remediation
References
Related Vulnerabilities
Ruby Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-2065)
WordPress Plugin Craw Data Server-Side Request Forgery (1.0.0)
Drupal Core 5.x Cross-Site Request Forgery (5.0 - 5.2)
WebLogic Improper Access Control Vulnerability (CVE-2026-35311)
Django Improper Authentication Vulnerability (CVE-2013-1443)