Magento incorrect user permissions vulnerability within the Inventory component

BASSO 2.7CVE-2020-24403 · BIT-magento-2020-24403 · GHSA-39rw-4m66-82gf · Published 09/11/2020 · updated 17/06/2026

Package	Affected versions	Patched versions
magento/community-edition Packagist	`≥ 2.4.0, < 2.4.1< 2.3.6`	`2.4.12.3.6`
magento/project-community-edition Packagist	`≤ 2.0.2`	No fix yet
magento magento	`= 2.3.5= 2.4.0< 2.3.5`	`2.3.5`

Description

Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect user permissions vulnerability within the Inventory component. This vulnerability could be abused by authenticated users with Inventory and Source permissions to make unauthorized changes to inventory source data via the REST API.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2020-24403 · ADVISORY
magento/magento2 · PACKAGE
helpx.adobe.com/security/products/magento/apsb20-59.html · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free