CVE-2021-21020

—

CVSS 3.0

5.3 medium

EPSS

2%p83

Published

Feb 11, 2021 (Feb 11, 2021)

Modified

Jun 17, 2026

Description

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an access control bypass vulnerability in the Login as Customer module. Successful exploitation could lead to unauthorized access to restricted resources.

Vendors: magento
Products: magento
Ecosystems: E-commerce
Weakness: CWE-284
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (2.4%)

In the news0 stories

No ingested article mentions this CVE yet.