The Magento Security Scan returned this vulnerability:

API ACL - Failed.
API ACL Patch not detected (APPSEC-1679)
Apply the Magento 2.0.14/2.1.7 Security Update immediately.

However, my site is running Magento 2.3.3 (released Oct 2019). The patch mentioned is dated May 31, 2017 and is for a much older version.

APPSEC-1679: APIs vulnerable to CSRF
Product(s) Affected: Magento CE and EE prior to 2.0.14/2.1.7
Fixed In: Magento CE and EE 2.0.14/2.1.7

Are other people seeing this error (false positive) with Magento 2.3.3 and the Magento Security Scan tool?

Is there anything else I should know about this particular reported issue with my site?

  • Do you require 2FA for all admin users?
    – Hunter
    Commented Dec 4, 2019 at 15:47
  • @Hunter - we are working on that as well as OAuth-based authentication.
    – BugBuddy
    Commented Dec 5, 2019 at 5:16
  • Try making 2FA mandatory for every admin account and trying again after
    – Hunter
    Commented Dec 10, 2019 at 20:59

1 Answer 1


From Magento support I got the following answer,

Please make sure that Configuration->Services->Magento Web API->Web API Security->Allow Anonymous Guest Access is set to "Off". It is probably turned on. Thank you!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.