OpenMage Magento-LTS before 20.18.2 Authorization Bypass via Forgeable RSS Order Key
CVE-2026-128045

6.9MEDIUM

Key Information:

Vendor

Openmage

Status
Magento-lts
Vendor
CVE Published:
13 November 2026

What is CVE-2026-128045?

OpenMage Magento-LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an authorization bypass in the /rss/order/status feed because its URL key is unsigned Base64-encoded JSON of the order, increment, and customer ids. Unauthenticated attackers can forge keys from enumerated sequential ids to read other customers' names, items, prices, totals, and status comments when order-status RSS is enabled.

Affected Version(s)

magento-lts 0 < 20.18.2

magento-lts 21.0.0-beta1 < 21.0.0-beta3

magento-lts 20.18.2

References

https://github.com/OpenMage/magento-lts/security/advisori...
vendor-advisory
https://github.com/OpenMage/magento-lts/commit/fde2d10929...
patch
https://www.vulncheck.com/advisories/openmage-magento-lts...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

bruhdev1290
colinmollenhour
Hanmac
.