CVE-2026-128032 · Package
NO FIX YET · SEE WHAT TO DO
OpenMage magento-lts accepts the free payment method on orders whose total is not zero, because the zero-total check runs only when payment data is imported. An API user with cart permissions can place an unpaid full-price order.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Stores running OpenMage magento-lts 20.x before 20.18.2 or 21.0.0-beta1 through beta2 that expose the SOAP/REST API to users with cart permissions. Stores without API access for customers or integrations, or with only trusted admin users on the API, are less exposed. The sources do not say whether the default configuration allows cart API access.
Not affected if no-api-cart-access, patched-version
Who cares e-commerce, magento, openmage, self-hosted
composer show openmage/magento-lts or the version shown in the admin footer.magento-lts before 20.18.2 (20.x line)magento-lts 21.0.0-beta1 before 21.0.0-beta3 (21.x beta line)OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 accepts the free (No Payment Information Required) payment method on orders with a non-zero total because the zero-total check runs only when payment data is imported. An API user with cart permissions can select free via cart_payment.method while the total is zero, raise it with cart_coupon.remove, and submit cart.order to place an unpaid full-price order.
This page as .md ·
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.