{"data":{"id":"magento2-38277","source":"github-pr","sourceRef":"magento/magento2#38277","title":"V1/customers/password endpoint question/issue","pr":{"number":38277,"url":"https://github.com/magento/magento2/pull/38277","author":"rogerdz","mergedAt":"2024-07-03T15:17:46Z","mergeCommit":"42f1b60fd0f1fe36e9f98dadce6883b6f1c79cae","headCommit":"6dddacbe10f0f1199c8d6070213a797dab3a509f","baseRef":"2.4-develop","diffSha256":"fa0045de8ddc4caadca1d74daf94327915ac3114889a77876639679c79fb3991"},"issues":[{"number":38238,"url":"https://github.com/magento/magento2/issues/38238","title":"V1/customers/password endpoint question/issue","labels":["Area: Framework","Component: Customer","Issue: Confirmed","Priority: P1","Progress: done","Reported on 2.4.x","Reproduced on 2.4.x","Triage: Dev.Experience"],"kind":"human"}],"fixedIn":"2.4.8","containingTags":["2.4.8","2.4.8-p1","2.4.8-p2","2.4.8-p3","2.4.8-p4","2.4.8-p5","2.4.9"],"reportedOn":null,"codeMatch":{"2.4.6":"clean","2.4.6-p1":"clean","2.4.6-p2":"clean","2.4.6-p3":"clean","2.4.6-p4":"clean","2.4.6-p5":"clean","2.4.6-p6":"clean","2.4.6-p7":"clean","2.4.6-p8":"clean","2.4.6-p9":"clean","2.4.6-p10":"clean","2.4.6-p11":"clean","2.4.6-p12":"clean","2.4.6-p13":"clean","2.4.6-p14":"clean","2.4.6-p15":"clean","2.4.7":"clean","2.4.7-p1":"clean","2.4.7-p2":"clean","2.4.7-p3":"clean","2.4.7-p4":"clean","2.4.7-p5":"clean","2.4.7-p6":"clean","2.4.7-p7":"clean","2.4.7-p8":"clean","2.4.7-p9":"clean","2.4.7-p10":"clean","2.4.8":"conflict","2.4.8-p1":"conflict","2.4.8-p2":"conflict","2.4.8-p3":"conflict","2.4.8-p4":"conflict","2.4.8-p5":"conflict","2.4.9":"conflict"},"affectedVersions":["2.4.6","2.4.6-p1","2.4.6-p2","2.4.6-p3","2.4.6-p4","2.4.6-p5","2.4.6-p6","2.4.6-p7","2.4.6-p8","2.4.6-p9","2.4.6-p10","2.4.6-p11","2.4.6-p12","2.4.6-p13","2.4.6-p14","2.4.6-p15","2.4.7","2.4.7-p1","2.4.7-p2","2.4.7-p3","2.4.7-p4","2.4.7-p5","2.4.7-p6","2.4.7-p7","2.4.7-p8","2.4.7-p9","2.4.7-p10"],"components":["magento/module-security"],"files":[{"path":"app/code/Magento/Security/Model/Plugin/AccountManagement.php","change":"modified","package":"magento/module-security"}],"stripped":{"tests":["app/code/Magento/Security/Test/Unit/Model/Plugin/AccountManagementTest.php"],"docs":[],"outsideCode":[]},"linesChanged":11,"mergeBatched":false,"excluded":null,"sections":{"description":null,"stepsToReproduce":null,"expectedResult":null,"actualResult":null,"source":null},"signatures":[],"labels":{"area":["Framework"],"component":["Customer"],"priority":"P1","severity":null,"reportedOn":["2.4.x"]},"categories":["Customer"],"triage":{"model":"@cf/cloudflare/clef","requestHash":"8522962d20e22d6e9239c9e3488e026d8c9c9264eec29df69ece530d190dcce1","isBugfix":0.9654,"changeKind":{"choice":"bugfix","probabilities":{"bugfix":0.9339,"feature":0.0255,"refactor":0.0193,"tests_only":0.0109,"docs_only":0.0046,"dependency":0.0058},"confidence":0.8481},"scope":{"score":0.4653,"probabilities":{"0":0.6122,"1":0.3103,"2":0.0775},"confidence":0.2157},"risk":{"score":0.6849,"probabilities":{"0":0.5814,"1":0.1523,"2":0.2663},"confidence":0.1482},"area":{"choice":"customer","probabilities":{"catalog":0.007,"checkout":0.0101,"customer":0.6971,"admin":0.02,"graphql_api":0.1525,"framework":0.0736,"frontend":0.0111,"other":0.0286},"confidence":0.447},"securityRelevant":0.9387,"reportedVersion":{"choice":"unspecified","probabilities":{"2.4.0":0.0037,"2.4.0-p1":0.0044,"2.4.1":0.0052,"2.4.1-p1":0.0044,"2.4.2":0.0073,"2.4.2-p1":0.0072,"2.4.2-p2":0.0091,"2.4.3":0.0122,"2.4.3-p1":0.0149,"2.4.3-p2":0.0144,"2.4.3-p3":0.0076,"2.4.4":0.0141,"2.4.4-p1":0.0104,"2.4.4-p10":0.0059,"2.4.4-p11":0.0087,"2.4.4-p12":0.0076,"2.4.4-p13":0.0073,"2.4.4-p14":0.0085,"2.4.4-p15":0.0066,"2.4.4-p16":0.0077,"2.4.4-p17":0.0069,"2.4.4-p18":0.0056,"2.4.4-p2":0.0029,"2.4.4-p3":0.0032,"2.4.4-p4":0.0034,"2.4.4-p5":0.0043,"2.4.4-p6":0.0053,"2.4.4-p7":0.0049,"2.4.4-p8":0.0049,"2.4.4-p9":0.0044,"2.4.5":0.0149,"2.4.5-p1":0.0132,"2.4.5-p10":0.0075,"2.4.5-p11":0.0122,"2.4.5-p12":0.0113,"2.4.5-p13":0.0083,"2.4.5-p14":0.0081,"2.4.5-p15":0.008,"2.4.5-p16":0.0079,"2.4.5-p17":0.0072,"2.4.5-p2":0.0038,"2.4.5-p3":0.0064,"2.4.5-p4":0.0059,"2.4.5-p5":0.0046,"2.4.5-p6":0.0061,"2.4.5-p7":0.0061,"2.4.5-p8":0.0054,"2.4.5-p9":0.0049,"2.4.6":0.025,"2.4.6-p1":0.0151,"2.4.6-p10":0.0087,"2.4.6-p11":0.0122,"2.4.6-p12":0.0096,"2.4.6-p13":0.0097,"2.4.6-p14":0.0097,"2.4.6-p15":0.008,"2.4.6-p2":0.0052,"2.4.6-p3":0.0085,"2.4.6-p4":0.0092,"2.4.6-p5":0.0081,"2.4.6-p6":0.0078,"2.4.6-p7":0.0082,"2.4.6-p8":0.0054,"2.4.6-p9":0.0053,"2.4.7":0.0138,"2.4.7-p1":0.0125,"2.4.7-p10":0.0094,"2.4.7-p2":0.009,"2.4.7-p3":0.013,"2.4.7-p4":0.0135,"2.4.7-p5":0.0111,"2.4.7-p6":0.0143,"2.4.7-p7":0.0105,"2.4.7-p8":0.0087,"2.4.7-p9":0.0077,"2.4.8":0.013,"2.4.8-p1":0.0133,"2.4.8-p2":0.015,"2.4.8-p3":0.0143,"2.4.8-p4":0.0128,"2.4.8-p5":0.0108,"2.4.9":0.0133,"unspecified":0.2735},"confidence":0.0713},"backportWorthy":{"score":1.6014,"probabilities":{"0":0.0693,"1":0.2599,"2":0.6708},"confidence":0.2834}},"curated":{"title":"V1/customers/password endpoint does not get the password reset security check","description":"Requests to the V1/customers/password endpoint did not get the password reset security check that the frontend area and admin password reset requests get. The AccountManagement plugin in Magento_Security now also does performSecurityCheck in beforeInitiatePasswordReset for the webapi_rest area with a customer password reset request.","categories":["Customer"],"author":"claude-code/opus-5.5","date":"2026-10-06","reviewedBy":null},"tests":{"2.4.7-p10":{"before":"fail","after":"pass","adapted":false,"runAt":"2026-10-06T09:29:05.857Z","releaseCommit":"72561bf80652f57cc642a03e2c9a51d74a285b14","suites":{"unit":{"before":"fail","after":"pass","runAt":"2026-10-06T09:29:05.857Z"}}}}},"_documentation":"https://magento.watch/api","_description":"Upstream fix magento2-38277 details"}