A stored cross-site scripting (XSS) vulnerability exists in OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta3. The flaw is in the Mage_Catalog_Model_Product_Option_Type_File component, which improperly neutralizes input when handling guest uploads of SVG, XHTML, or XML files with an empty allowed-extension list. This allows unauthenticated attackers to craft URLs that execute scripts in the store's origin, potentially exposing administrator sessions if the admin panel shares the same origin.
OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta3 contain a stored cross-site scripting (XSS) vulnerability in the Dataflow profile run page. This flaw allows unauthenticated attackers to inject malicious markup via import files, which is then executed in the administrator's session during product import. The vulnerability is fixed in versions 20.18.2 and 21.0.0-beta3.
OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta3 have an insufficient session expiration vulnerability. The flaw allows continued API access via SOAP/XML-RPC sessions or OAuth tokens even after user deactivation or API key rotation. This affects administrative API access, potentially exposing customer, order, and catalog data.
OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta3 contain an incorrect authorization vulnerability. This flaw arises because admin controllers' _isAllowed() checks rely on parent ACL resources rather than enforcing finer-grained per-action permissions. As a result, authenticated restricted administrators can perform unauthorized actions such as mass canceling or holding orders, rewriting order shipping addresses, exporting customer report data, or creating REST roles despite their role restrictions.
OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta3 have a vulnerability where the free payment method can be improperly used on orders with a non-zero total. This occurs because the zero-total check is only performed when payment data is imported, allowing an API user with cart permissions to manipulate the cart to place an unpaid full-price order.
CVE-2026-128033 is an information disclosure vulnerability in OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta3. The flaw exists in the Mage_Rss_Model_Resource_Order::getAllCommentCollection() method, which fails to filter out internal staff comments such as fraud-review and payment notes from the order status RSS feed. Authenticated customers can access this feed for their own orders and view sensitive internal comments not intended for them.
OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta3 contain a stored cross-site scripting (XSS) vulnerability. This flaw arises because certain admin page elements such as Dataflow profile link variables, tax rate titles, OAuth consumer names, and PayPal certificate filenames are rendered without proper escaping. An administrator with restricted access can inject malicious scripts that execute when another administrator views the affected page, potentially allowing privilege escalation through session hijacking or unauthorized actions.
OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta3 serve RSS feeds with a text/html content type without escaping feed entry data, resulting in stored cross-site scripting (XSS). An unauthenticated guest can submit a product review containing malicious script in the nickname, title, or text fields. This script executes when an administrator views the pending-reviews RSS feed, potentially leading to administrator account takeover.
OpenMage magento-lts versions before 20.19.0 and 21.0.0-beta3 contain a race condition in the shopping cart price rule usage limits. This flaw allows unauthenticated attackers, including guest shoppers, to exploit concurrent checkouts to redeem limited-use coupons more times than intended. The issue arises because the coupon usage counters are checked and incremented without proper synchronization, leading to improper enforcement of coupon limits.
CVE-2026-128043 is a low-severity cross-site request forgery (CSRF) vulnerability in OpenMage magento-lts versions before 20.19.0 and 21.0.0-beta3. The flaw exists in the PayPal cancel and decline return handlers, which rely solely on the checkout session without verifying that requests originate from PayPal. An attacker can exploit this by tricking a shopper into visiting a crafted URL that cancels their uninvoiced order, voids pending authorizations, and restores items to the cart.
CVE-2026-128044 is a vulnerability in OpenMage magento-lts versions before 20.18.2 and 21.x before 21.0.0-beta3. It involves improper validation of OAuth 1.0a oauth_callback URLs, allowing attackers with leaked consumer credentials to manipulate callback URLs and capture request tokens and verifiers. This enables them to obtain access tokens with the victim's API privileges.
OpenMage Magento-LTS versions before 20.18.2 and 21.0.0-beta3 contain an authorization bypass vulnerability in the /rss/order/status feed. The URL key used for authorization is an unsigned Base64-encoded JSON object containing order, increment, and customer IDs. This allows unauthenticated attackers to forge keys by enumerating sequential IDs and access other customers' order details including names, items, prices, totals, and status comments when the order-status RSS feed is enabled.
OpenMage magento-lts versions 20.17.0 before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 have an unrestricted file upload vulnerability. The vulnerability arises because the blocklist for disallowed file extensions in the general/file/protected_extensions setting omits certain dangerous extensions such as phar, php8, and phps. This omission allows unauthenticated attackers to upload .phar files via product File custom options to a predictable path and execute code on servers that treat .phar files as PHP scripts.
OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta pre-releases before 21.0.0-beta3 use insufficiently random values for generating customer email-confirmation keys and password-reset tokens. The keys are generated using md5(uniqid()) and uniqHash(), which are not cryptographically secure. This allows unauthenticated attackers to brute-force email-confirmation keys via an unrate-limited endpoint and potentially predict administrator reset tokens after recovering the generator state.
CVE-2026-128048 is a vulnerability in OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta3. It allows restricted administrators with access to Transactional Emails to read decrypted configuration secrets by exploiting improper handling of case sensitivity in the store.getConfig email template directive. This flaw exposes sensitive credentials such as PayPal, payment gateway, and carrier information.
CVE-2026-128049 is a critical cross-site request forgery (CSRF) vulnerability in OpenMage Magento LTS versions before 20.18.2 and 21.0.0-beta3. The flaw exists in the admin and storefront OAuth confirm and confirmSimple actions, which accept GET requests without form-key validation. An attacker with OAuth consumer credentials can trick a logged-in administrator or customer into authorizing the attacker's request token, enabling the attacker to obtain a persistent REST API access token bound to the victim.
OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta3 contain a stored cross-site scripting (XSS) vulnerability. This flaw arises because certain storefront templates output product names without proper escaping, allowing attackers with admin product-edit rights to inject malicious scripts. These scripts execute when shoppers view affected pages such as product, category, or wishlist pages. The vulnerability has a medium severity with a CVSS score of 4.8 and is fixed in versions 20.18.2 and 21.0.0-beta3.
CVE-2026-128052 is an incorrect authorization vulnerability in OpenMage magento-lts before versions 20.19.0 and 21.0.0-beta3. The flaw exists in the template filter's {{layout}} directive, which allows rendering of arbitrary layout handles without enforcing the admin/block whitelist that applies to the {{block}} directive. Administrators with permissions to edit email, CMS, widget, or newsletter content can exploit this to embed {{layout}} with arbitrary handles, potentially rendering disallowed blocks and disclosing limited information.
OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta3 contain a reflected cross-site scripting (XSS) vulnerability in error pages. The flaw arises because SCRIPT_NAME-derived URLs are included in error pages without proper escaping, allowing unauthenticated attackers to craft malicious links that execute scripts in the context of the storefront origin. This vulnerability has a low severity rating and is fixed in versions 20.18.2 and 21.0.0-beta3.
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, Mage_ProductAlert_AddController::stockAction() reads the uenc query parameter and passes it directly to $this->_redirectUrl($backUrl) without calling $this->_isUrlInternal(). When the supplied product_id does not match any catalog product, the server issues an unvalidated HTTP 302 redirect to whatever URL was provided as uenc. This vulnerability is fixed in 20.18.0.