Bruhdev1290

OpenMage Magento-LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an authorization bypass in the /rss/order/status feed because its URL key is unsigned Base64-encoded JSON of the order, increment, and customer ids. Unauthenticated attackers can forge keys from enumerated sequential ids to read other customers' names, items, prices, totals, and status comments when order-status RSS is enabled.

Repository and organization project boards failed to verify if a viewer had the necessary permissions to read pull requests that referenced issues on the board. This allowed users, including anonymous visitors of public boards, to see the path of a private repository, as well as the number, title, and state of private pull requests. The pull request body, diff, and files remained protected.