{"id":"CVE-2026-128030","kind":"vulnerability","aliases":["CVE-2026-128030"],"related":[],"title":"OpenMage magento-lts: deactivated API users keep access via sessions","description":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an insufficient session expiration vulnerability because Mage_Api_Model_Session::_renewBySessId() never checks api_user.is_active and REST OAuth authorization never checks whether the admin user is active. Attackers holding an existing SOAP/XML-RPC session or OAuth access token retain API access after deactivation or API key rotation, reading and modifying customer, order and catalog data.","summary":"OpenMage magento-lts does not check whether an API user is still active when renewing a SOAP or XML-RPC session, and REST OAuth does not check whether the admin user is active. An attacker holding an existing session or OAuth token keeps API access after the user is deactivated or keys are rotated, and can read and change customer, order and catalog data.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e-commerce","magento","openmage","package","php","self-hosted"],"not_affected_if":["api-disabled","managed-hosting","no-soap-or-oauth-integrations"],"how_to_check":"- Confirm the installed OpenMage magento-lts version in composer.json or the release tag and compare it with `20.18.2` (stable line) and `21.0.0-beta3` (beta line)\n- Check whether the store exposes the SOAP/XML-RPC API or REST OAuth integrations to the internet\n- Review active API users and OAuth tokens for accounts that should have been deactivated","fix":"- magento-lts: move to `20.18.2` or later on the 20.x line\n- magento-lts 21.0.0 beta: move to `21.0.0-beta3` or later","status":"open","published_at":"2026-11-13T10:18:08+00:00","first_seen_at":"2026-11-13T10:47:31+00:00","triaged_at":"2026-11-13T10:52:46+00:00","updated_at":"2026-11-13T10:52:46+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T10:52:46Z","model":"claude-haiku-5-5","output":{"fix":"- magento-lts: move to `20.18.2` or later on the 20.x line\n- magento-lts 21.0.0 beta: move to `21.0.0-beta3` or later","reach":"network","title":"OpenMage magento-lts: deactivated API users keep access via sessions","impact":"high","summary":"OpenMage magento-lts does not check whether an API user is still active when renewing a SOAP or XML-RPC session, and REST OAuth does not check whether the admin user is active. An attacker holding an existing session or OAuth token keeps API access after the user is deactivated or keys are rotated, and can read and change customer, order and catalog data.","audience":"businesses","category":"package","nicknames":[],"who_cares":["magento","openmage","php","self-hosted","e-commerce"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Former API users read and modify customer, order and catalog data","analyst_note":"","how_to_check":"- Confirm the installed OpenMage magento-lts version in composer.json or the release tag and compare it with `20.18.2` (stable line) and `21.0.0-beta3` (beta line)\n- Check whether the store exposes the SOAP/XML-RPC API or REST OAuth integrations to the internet\n- Review active API users and OAuth tokens for accounts that should have been deactivated","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["api-disabled","managed-hosting","no-soap-or-oauth-integrations"],"who_is_affected":"Stores running OpenMage magento-lts (a Magento 1 fork) that expose the SOAP/XML-RPC API or REST OAuth integrations. Exposure depends on whether API users or integration tokens are ever deactivated or rotated, since that is when the flaw lets old access persist. Sites without API integrations can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000817,"input_tokens":4706,"output_tokens":693,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-128030':14A,17A '-2026':13A,16A '20.18.2':99C '21.0.0':101C,104C 'access':9A,74B,142C,146C 'activ':41B,62B,121C,133C 'admin':59B,130C 'api':6A,37B,73B,114C,145C,150C 'api_user.is':120C 'attack':64B,134C 'author':125C 'beta1':102C 'beta3':105C 'catalog':92B,159C 'chang':88B 'check':34B,56B,119C,127C 'commerc':20B 'contain':106C 'custom':89B,156C 'cve':12A,15A 'data':93B,160C 'deactiv':5A,79B,148C 'e':19B 'e-commerc':18B 'exist':67B,137C 'expir':110C 'hold':65B,135C 'host':27B 'insuffici':108C 'keep':8A,72B 'key':81B,151C 'lts':4A,31B,97C 'mage':113C 'magento':3A,21B,30B,96C 'magento-lt':2A,29B,95C 'model':115C 'modifi':155C 'never':118C,126C 'oauth':53B,70B,124C,141C 'openmag':1A,22B,28B,94C 'order':90B,157C 'packag':23B 'php':24B 'read':86B,153C 'renew':43B 'renewbysessid':117C 'rest':52B,123C 'retain':144C 'rotat':83B,152C 'rpc':49B 'self':26B 'self-host':25B 'session':11A,50B,68B,109C,116C,139C 'soap':45B 'soap/xml-rpc':138C 'still':40B 'token':71B,143C 'user':7A,38B,60B,77B,131C 'via':10A 'vulner':111C 'whether':35B,57B,128C 'xml':48B 'xml-rpc':47B","nicknames":[],"mitigations":[],"who_affected":"Stores running OpenMage magento-lts (a Magento 1 fork) that expose the SOAP/XML-RPC API or REST OAuth integrations. Exposure depends on whether API users or integration tokens are ever deactivated or rotated, since that is when the flaw lets old access persist. Sites without API integrations can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ecommerce","high","magento","openmage","package","php","selfhosted"],"campaign_type":null,"search_a":"'-128030':14A,17A '-2026':13A,16A 'access':9A 'api':6A 'cve':12A,15A 'deactiv':5A 'keep':8A 'lts':4A 'magento':3A 'magento-lt':2A 'openmag':1A 'session':11A 'user':7A 'via':10A","search_b":"'access':74B 'activ':41B,62B 'admin':59B 'api':37B,73B 'attack':64B 'catalog':92B 'chang':88B 'check':34B,56B 'commerc':20B 'custom':89B 'data':93B 'deactiv':79B 'e':19B 'e-commerc':18B 'exist':67B 'hold':65B 'host':27B 'keep':72B 'key':81B 'lts':31B 'magento':21B,30B 'magento-lt':29B 'oauth':53B,70B 'openmag':22B,28B 'order':90B 'packag':23B 'php':24B 'read':86B 'renew':43B 'rest':52B 'rotat':83B 'rpc':49B 'self':26B 'self-host':25B 'session':50B,68B 'soap':45B 'still':40B 'token':71B 'user':38B,60B,77B 'whether':35B,57B 'xml':48B 'xml-rpc':47B","search_c":"'20.18.2':99C '21.0.0':101C,104C 'access':142C,146C 'activ':121C,133C 'admin':130C 'api':114C,145C,150C 'api_user.is':120C 'attack':134C 'author':125C 'beta1':102C 'beta3':105C 'catalog':159C 'check':119C,127C 'contain':106C 'custom':156C 'data':160C 'deactiv':148C 'exist':137C 'expir':110C 'hold':135C 'insuffici':108C 'key':151C 'lts':97C 'mage':113C 'magento':96C 'magento-lt':95C 'model':115C 'modifi':155C 'never':118C,126C 'oauth':124C,141C 'openmag':94C 'order':157C 'read':153C 'renewbysessid':117C 'rest':123C 'retain':144C 'rotat':152C 'session':109C,116C,139C 'soap/xml-rpc':138C 'token':143C 'user':131C 'vulner':111C 'whether':128C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-26T20:00:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128030","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128030","severity":null,"published_at":"2026-11-13T10:18:08+00:00","modified_at":"2026-11-13T10:18:08+00:00","first_seen_at":"2026-11-13T10:47:31+00:00","fetched_at":"2026-11-13T10:47:31+00:00","note":null}],"documents":[{"id":145364,"url":"https://github.com/OpenMage/magento-lts/commit/73048b7d8380fefb423869342c708ac30f80bc4b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145365,"url":"https://github.com/OpenMage/magento-lts/commit/9daf2c647759816ade7be2c906f08f56cb43a864","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145366,"url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-rrhg-c635-fmrm","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T20:00:01+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145367,"url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-insufficient-session-expiration-after-api-user-deactivation","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}