https://vulnerability.circl.lu/sightings/feed 2026-09-10T19:06:31.547975+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/66836c5b-c93f-4ddd-ad40-24c1e0fda6f8/export 2026-09-10T19:06:31.561681+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "66836c5b-c93f-4ddd-ad40-24c1e0fda6f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79324", "type": "seen", "source": "https://bsky.app/profile/experiencedigest.bsky.social/post/3mv4vc65n6b2c", "content": "CVE-2026-79324 (HIGH) CVSS 7.5: https://experiencedigest.org/2026/09/09/212232.html", "creation_timestamp": "2026-09-10T01:23:22.358722Z"} 2026-09-10T01:23:22.358722+00:00 https://vulnerability.circl.lu/sighting/e7f69f55-532c-4132-81bf-411a621b93f4/export 2026-09-10T19:06:31.563240+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "e7f69f55-532c-4132-81bf-411a621b93f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79324", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mv4gnst4o42s", "content": "\ud83d\udfe0 CVE-2026-79324 - High (7.5)\n\nMissing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-79324/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-09T21:01:28.081519Z"} 2026-09-09T21:01:28.081519+00:00 https://vulnerability.circl.lu/sighting/5e712629-3953-49c2-8148-cfc1a2dd2306/export 2026-09-10T19:06:31.563374+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "5e712629-3953-49c2-8148-cfc1a2dd2306", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79324", "type": "seen", "source": "https://gist.github.com/mrtantoine/4311aa0c267c7a77c15d292820eb3c36", "content": "# CVE-2026-79324 \u2014 Unauthenticated Deletion of Any Customer Address in Mageplaza GDPR for Magento 2 through 4.2.9\n\n## Summary\n\nMissing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza/module-gdpr) through 4.2.9 allows remote unauthenticated attackers to delete any customer's saved address, and to erase all stored addresses by iterating the address id, via a GET request to /customer/address/delete/id/{id}. The controller extends the legacy Action class instead of AbstractAccount, so no authentication, ownership or form key check is enforced.\n\n## Affected\n\n- Product: Mageplaza GDPR for Magento 2 (mageplaza/module-gdpr)\n- Versions: through 4.2.9 (current latest release, published 2026-07-13; no fixed version available)\n- Authentication required: none (unauthenticated)\n\n## Details\n\nThe module registers etc/frontend/routes.xml with , so Mageplaza\\Gdpr\\Controller\\Address\\Delete handles /customer/address/delete/id/{id} instead of the Magento core controller.\n\nThe controller extends Magento\\Framework\\App\\Action\\Action (line 37), not AbstractAccount, so the customer login plugin bound to AbstractAccount never runs. execute() reads the id from the request (line 71) and calls $this->_addressRepository->deleteById($addressId) (line 74) with no isLoggedIn check, no ownership verification and no form key.\n\nThe constructor injects neither the customer session nor an authorization helper. execute() never calls isLoggedIn(), never reads the session customer id, and never verifies that the address belongs to the caller. Because the class extends the legacy Action, the Magento\\Customer\\Controller\\Plugin\\Account login gate does not apply, and a GET requires no form key.\n\nThe same module ships the correctly protected sibling Controller/Account/Delete.php, which extends AbstractAccount and checks isLoggedIn() (line 123), which shows the missing gate on the address controller is an oversight rather than intended behaviour.\n\nVerified on a local Mage-OS lab running Mageplaza GDPR 4.2.9 (latest). A saved address (entity_id 6, owned by customer 1) was deleted by an unauthenticated GET to /customer/address/delete/id/6 (HTTP 302 to /customer/address/, processed), while an anonymous GET to /customer/address/ returns HTTP 302 to the login page. After the request, SELECT COUNT(*) FROM customer_address_entity WHERE entity_id = 6 returns 0.\n\n## Attack vector\n\nSingle unauthenticated HTTP GET to /customer/address/delete/id/{id} where {id} is an attacker-chosen address entity id. No account, cookie, form key or user interaction required. Iterating the numeric id deletes every saved customer address in the store.\n\n## Impact\n\nAn unauthenticated attacker deletes any customer's stored address, and by iterating id 1..N erases every saved address in the store. This is a store-wide integrity and data-loss issue affecting customer PII and degrading checkout for the affected customers. No account, cookie, form key or user interaction is required. On a module whose purpose is GDPR data handling, the endpoint that should be the most access-controlled is the least.\n\n## CVSS 3.1\n\nAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N = 7.5 (High)\n\n## Remediation\n\nGate the controller like its sibling: extend Magento\\Customer\\Controller\\AbstractAccount, verify $this->customerSession->isLoggedIn(), and confirm the target address belongs to the session customer ($address->getCustomerId() === $this->customerSession->getCustomerId()) before calling deleteById. Require a valid form key and use POST for the state change.\n\n## References\n\n- https://packagist.org/packages/mageplaza/module-gdpr\n- https://www.mageplaza.com/magento-2-gdpr/\n- CWE-862 Missing Authorization\n- CWE-639 Authorization Bypass Through User-Controlled Key (IDOR)\n\n## Credit\n\nDiscovered by Antoine Morato.", "creation_timestamp": "2026-09-08T21:28:11.446683Z"} 2026-09-08T21:28:11.446683+00:00