Magebean Logo Magebean
← Back to Baseline

MB-R100

AUTOMATED Admin role assignments are valid

MB-C02 Admin & Auth Hardening High

Active Magento Admin users have valid role and ACL assignments.

Why it Matters

Admin users without valid role assignments are hard to review and can hide stale privileged access. Broken relationships between admin_user, authorization_role, and authorization_rule make authorization behavior unpredictable and weaken accountability.

Every active admin account should map cleanly to an active, intentional role so access remains explicit and auditable.

Verification Steps

Database relationship review

  • Review active admin users and role assignments
  • Expected: every active admin user has a valid active parent role
  • Check for orphaned authorization_role records or missing parent roles

Evidence handling

  • If database evidence is unavailable
  • Expected: UNKNOWN, not PASS

Remediation / Fix Guidance

  1. Assign every active admin user to an approved role.
  2. Remove stale admin users that no longer require access.
  3. Repair or remove orphaned authorization_role records.
  4. Document role ownership and review it on a regular cadence.
  5. Treat missing evidence as a review item instead of assuming the state is safe.

Examples

Fail Example
Active admin user exists with no valid assigned role
# Access state is unclear → FAIL
Pass Example
Every active admin user maps to an approved active role
# Role assignment is explicit and reviewable → PASS

References