CVE-2026-128048: OpenMage magento-lts before 20.18.2 Information Disclosure via Email Template getConfig
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 lets restricted administrators read decrypted configuration secrets because the store.getConfig email template directive's encrypted-path check missed config.xml-declared paths, case variants of the getConfig method name, and parent paths. Administrators with Transactional Emails access can preview a crafted template to expose PayPal, payment gateway, and carrier credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.18.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 21.0.0-beta3
Event History
Frequently Asked Questions
Which administrators are realistically able to exploit this issue?
Administrators who have access to Transactional Emails can craft and preview an email template using the store.getConfig directive. The issue affects restricted administrators, not only fully privileged administrators.
What information could be exposed?
A successful exploit can reveal decrypted configuration secrets, including PayPal credentials, other payment gateway credentials, and carrier credentials.
Which releases are affected?
Affected releases are magento-lts before 20.18.2 and 21.0.0-beta1 through before 21.0.0-beta3. Updating to 20.18.2 or 21.0.0-beta3 addresses the affected version ranges.
What can be done if an update cannot be applied immediately?
Restrict Transactional Emails access for administrators who do not require it. This prevents those restricted administrators from previewing crafted templates through the vulnerable path.