CVE-2026-128045: OpenMage Magento-LTS before 20.18.2 Authorization Bypass via Forgeable RSS Order Key
OpenMage Magento-LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an authorization bypass in the /rss/order/status feed because its URL key is unsigned Base64-encoded JSON of the order, increment, and customer ids. Unauthenticated attackers can forge keys from enumerated sequential ids to read other customers' names, items, prices, totals, and status comments when order-status RSS is enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenMage Magento-LTSto a version that resolves this vulnerability.Fixed in 20.18.2 - Upgrade
Upgrade
OpenMage Magento-LTSto a version that resolves this vulnerability.Fixed in 21.0.0-beta3
Event History
Frequently Asked Questions
Which deployments are exposed?
OpenMage Magento-LTS versions before 20.18.2 are affected, as are 21.0.0 beta releases before 21.0.0-beta3. Exposure requires the order-status RSS feed to be enabled.
What does an attacker need to exploit this issue?
No authentication or user interaction is required. An attacker can forge RSS URL keys because they are unsigned Base64-encoded JSON and use enumerated sequential order, increment, and customer IDs.
What information could be disclosed?
Successful exploitation can expose other customers' names, ordered items, prices, order totals, and status comments.
What can be done if updating is not immediately possible?
Disable the order-status RSS feed to prevent access through the affected /rss/order/status endpoint.