Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2020-24405: Authenticated Users Can Modify Inventory Stock Data in Magento
CVE-2020-24405 · published 5 years ago
Summary
Magento versions 2.4.0 and 2.3.5p1 (and earlier) have a bug that allows authorized users to change inventory levels without permission. This could lead to incorrect stock counts and financial issues. Update to a patched version to fix this issue.
What to do
- Update magento community-edition to version 2.3.6.
- Update magento community-edition to version 2.4.1.
- Update magento magento to version 2.3.5 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | magento | community-edition |
<= 2.3.5-p2 >= 2.4.0, < 2.4.1 Fix: upgrade to 2.3.6
|
| – | magento | magento |
< 2.3.5 2.3.5 2.4.0 cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:* |
Original advisory text
Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions issue vulnerability in the Inventory module. This vulnerability could be abused by authenticated users to mo...
Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions issue vulnerability in the Inventory module. This vulnerability could be abused by authenticated users to modify inventory stock data without authorization.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-285Improper Authorization
Timeline
Published9 Nov 2020
Updated31 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta