AUTOMATED Global Admin ACL limited to approved roles

Why it Matters

Magento roles granted Magento_Backend::all can perform broad administrative actions. If global access is not limited to explicitly approved break-glass or super-administrator roles, least privilege is lost and account compromise becomes much more damaging.

Global ACL access should be exceptional, documented, and tied to known authorized users.

Verification Steps

Remediation / Fix Guidance

1. Limit Magento_Backend::all to approved administrator roles only.
2. Move operational users to least-privilege resource assignments.
3. Document approved exceptions and break-glass access.
4. Review users who inherit global access after staffing or agency changes.
5. Return UNKNOWN when database evidence is unavailable.

Examples

Marketing role has Magento_Backend::all
# Unapproved global admin access → FAIL

Only documented super-admin and break-glass roles have Magento_Backend::all
# Global access is approved and reviewable → PASS

References

• OWASP Top 10 — A01: Broken Access Control
• OWASP Top 10 — A07: Identification and Authentication Failures