Advisories for Composer/Oro/Customer-Portal package

2024

Storefront user can access history and most viewed data from matching back-office user with the same ID

Navigation history, most viewed and favorite navigation items are returned to storefront user in JSON navigation response if ID of storefront user matches ID of back-office user.

2023

OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility

Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks.