---
id: "CVE-2026-128030"
page: "https://infrastack.ai/live/CVE-2026-128030"
kind: "vulnerability"
aliases: ["CVE-2026-128030"]
title: "OpenMage magento-lts: deactivated API users keep access via sessions"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["e-commerce", "magento", "openmage", "package", "php", "self-hosted"]
not_affected_if: ["api-disabled", "managed-hosting", "no-soap-or-oauth-integrations"]
published_at: "2026-11-13T10:18:08+00:00"
first_seen_at: "2026-11-13T10:47:31+00:00"
updated_at: "2026-11-13T10:52:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-128030", "first_seen_at": "2026-11-13T10:47:31+00:00"}]
exploit_sources: []
---

# OpenMage magento-lts: deactivated API users keep access via sessions

Link for people: https://infrastack.ai/live/CVE-2026-128030 (this .md is for agents)

OpenMage magento-lts does not check whether an API user is still active when renewing a SOAP or XML-RPC session, and REST OAuth does not check whether the admin user is active. An attacker holding an existing session or OAuth token keeps API access after the user is deactivated or keys are rotated, and can read and change customer, order and catalog data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the installed OpenMage magento-lts version in composer.json or the release tag and compare it with `20.18.2` (stable line) and `21.0.0-beta3` (beta line)
- Check whether the store exposes the SOAP/XML-RPC API or REST OAuth integrations to the internet
- Review active API users and OAuth tokens for accounts that should have been deactivated

## Fix

- magento-lts: move to `20.18.2` or later on the 20.x line
- magento-lts 21.0.0 beta: move to `21.0.0-beta3` or later

## Timeline

- 2026-11-13T10:47:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-128030

## Documents

- [advisory] Vendor advisory: github.com https://github.com/OpenMage/magento-lts/security/advisories/GHSA-rrhg-c635-fmrm
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-insufficient-session-expiration-after-api-user-deactivation
- [fix] Patch: github.com https://github.com/OpenMage/magento-lts/commit/73048b7d8380fefb423869342c708ac30f80bc4b
- [fix] Patch: github.com https://github.com/OpenMage/magento-lts/commit/9daf2c647759816ade7be2c906f08f56cb43a864

## From the sources

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an insufficient session expiration vulnerability because Mage_Api_Model_Session::_renewBySessId() never checks api_user.is_active and REST OAuth authorization never checks whether the admin user is active. Attackers holding an existing SOAP/XML-RPC session or OAuth access token retain API access after deactivation or API key rotation, reading and modifying customer, order and catalog data.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_