C-Brown

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 lets restricted administrators read decrypted configuration secrets because the store.getConfig email template directive's encrypted-path check missed config.xml-declared paths, case variants of the getConfig method name, and parent paths. Administrators with Transactional Emails access can preview a crafted template to expose PayPal, payment gateway, and carrier credentials.

A cross-site request forgery issue exists in the admin and storefront OAuth confirm and confirmSimple actions. These actions accept GET requests without validating the `form-key` variable. An attacker possessing OAuth consumer credentials can trick an authenticated administrator or customer into visiting a specially crafted URL. This action authorizes the attacker's request token, which can then be exchanged at the '/oauth/token' endpoint for a persistent REST API access token linked to the victim's account.