Skip to content

Missing permission check for Omnisend plugin configuration page #8057

@atiq-bs23

Description

@atiq-bs23

The Omnisend plugin configuration page does not verify whether the current user has the MANAGE_PLUGINS permission.
As a result, users without this permission can still access the configuration page directly via URL.

This behavior may lead to unauthorized access to plugin configuration settings.

Steps to Reproduce:

  1. Create a new role.
  2. Assign Admin area access to the role.
  3. Ensure the role does NOT have the MANAGE_PLUGINS permission.
  4. Log in with a user assigned to this role.
  5. Manually navigate to: https://{YOUR_DOMAIN}/Admin/Omnisend/Configure

Actual Result
The Omnisend configuration page is displayed successfully.

Expected Result
Access should be denied.

Suggested Fix
Add a permission check for MANAGE_PLUGINS in the Omnisend plugin configuration controller/action.

Image

Metadata

Metadata

Assignees

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions