Magento cross-site request forgery (CSRF) vulnerability via the GraphQL API

MEDIUM 4.3CVE-2021-21027 · BIT-magento-2021-21027 · GHSA-h4xc-577p-hgj9 · Published 11/02/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
magento/community-edition Packagist	`≥ 2.4.0, < 2.4.2< 2.3.6-p1`	`2.4.22.3.6-p1`
magento/project-community-edition Packagist	`≤ 2.0.2`	No fix yet
magento magento	`= 2.3.6= 2.4.0= 2.4.1< 2.3.6`	`2.3.6`

Description

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via the GraphQL API. Successful exploitation could lead to unauthorized modification of customer metadata by an unauthenticated attacker. Access to the admin console is not required for successful exploitation.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2021-21027 · ADVISORY
magento/magento2 commit a2eb7e2 · WEB
magento/magento2 commit a349e02 · WEB
magento/magento2 · PACKAGE
helpx.adobe.com/security/products/magento/apsb21-08.html · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free