Magebean Logo Magebean
← Back to Baseline

MB-R101

Global Admin ACL limited to approved roles

C02 Admin Hardening High

Magento Admin roles granted global access through Magento_Backend::all must be limited to explicitly approved break-glass or super-administrator roles and their authorized users. All other roles should use least-privilege resource assignments appropriate to their operational responsibilities. The audit must identify each globally privileged role and the users who inherit it, then compare them with the project-approved exception policy. Missing approval evidence or unapproved global access must fail the rule; unavailable database evidence must produce an UNKNOWN result.

Why it Matters

Magento roles granted Magento_Backend::all can perform broad administrative actions. If global access is not limited to explicitly approved break-glass or super-administrator roles, least privilege is lost and account compromise becomes much more damaging.

Global ACL access should be exceptional, documented, and tied to known authorized users.

Verification Steps

Global ACL review

  • Identify roles with Magento_Backend::all
  • Expected: only approved super-admin or break-glass roles have global access

User inheritance review

  • List users inheriting globally privileged roles
  • Expected: all users are authorized by project policy

Remediation / Fix Guidance

  1. Limit Magento_Backend::all to approved administrator roles only.
  2. Move operational users to least-privilege resource assignments.
  3. Document approved exceptions and break-glass access.
  4. Review users who inherit global access after staffing or agency changes.
  5. Return UNKNOWN when database evidence is unavailable.

Examples

Fail Example
Marketing role has Magento_Backend::all
# Unapproved global admin access → FAIL
Pass Example
Only documented super-admin and break-glass roles have Magento_Backend::all
# Global access is approved and reviewable → PASS

References