ACSD-53414: Restricted admin users can see CMS pages beyond their permissions scope

Categories

Admin

Components

magento/module-admin-gws

Origin

adobe-commerce-support

Since QPT

1.1.40

Issue

Restricted admin users can see CMS pages beyond their permissions scope.

Steps to reproduce

1. Create a new website (sub_website), store (sub_store), and storeview (sub_storeview). 1. Create a sub_expert role, allowing the scope of sub_website and sub_store. Assign the following permissions only: Dashboard and Pages. 1. Create a new admin user and assign it to the sub_expert role. 1. Assign the following CSM pages to sub_storeview and default storeview. * 404 Not Found > Sub storeview * 503 Service Unavailable > Default storeview 1. Sign in to the Admin using the admin user created in Step 3. 1. Check the CMS page grid.

Adobe's page lists 2.4.6 - 2.4.6-p3 as compatible; the versions below are resolved from the current QPT constraints and are the ones the tool will offer.

Adobe scheduled the permanent fix for 2.4.7.

Install

Install the Quality Patches Tool with composer require magento/quality-patches, apply the prerequisites listed for all files applicable to your distribution and version first, then run vendor/bin/magento-patches apply ACSD-53414. On Cloud, add ACSD-53414 under stage.build.QUALITY_PATCHES in .magento.env.yaml.

For cweagans/composer-patches, choose a compatible version below and download the bundle. Copy its ACSD-53414/ folder into patches/composer/, merge composer.patches.json into composer.json, then run composer install. Bundle prerequisites the same way and list them first. Paths are relative to each package root, using the default -p1 level. Prefer local files when configuring composer-patches; a remote URL can change.

Patch files and compatible versions

Sources

• Adobe documentation for ACSD-53414
• JSON API: /api/v1/patches/ACSD-53414