{"id":"CVE-2026-128032","kind":"vulnerability","aliases":["CVE-2026-128032"],"related":[],"title":"OpenMage magento-lts: free payment method accepts unpaid full-price orders via API","description":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 accepts the free (No Payment Information Required) payment method on orders with a non-zero total because the zero-total check runs only when payment data is imported. An API user with cart permissions can select free via cart_payment.method while the total is zero, raise it with cart_coupon.remove, and submit cart.order to place an unpaid full-price order.","summary":"OpenMage magento-lts accepts the free payment method on orders whose total is not zero, because the zero-total check runs only when payment data is imported. An API user with cart permissions can place an unpaid full-price order.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e-commerce","magento","openmage","package","self-hosted"],"not_affected_if":["no-api-cart-access","patched-version"],"how_to_check":"- Check the installed magento-lts version: `composer show openmage/magento-lts` or the version shown in the admin footer.\n- Confirm whether API users have cart permissions (cart_payment.method, cart_coupon.remove, cart.order) in the API role configuration.","fix":"- `magento-lts` before `20.18.2` (20.x line)\n- `magento-lts` `21.0.0-beta1` before `21.0.0-beta3` (21.x beta line)","status":"open","published_at":"2026-11-13T10:18:09+00:00","first_seen_at":"2026-11-13T10:47:31+00:00","triaged_at":"2026-11-13T10:56:43+00:00","updated_at":"2026-11-13T10:56:43+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:56:43Z","model":"claude-haiku-5-5","output":{"fix":"- `magento-lts` before `20.18.2` (20.x line)\n- `magento-lts` `21.0.0-beta1` before `21.0.0-beta3` (21.x beta line)","reach":"network","title":"OpenMage magento-lts: free payment method accepts unpaid full-price orders via API","impact":"medium","summary":"OpenMage magento-lts accepts the free payment method on orders whose total is not zero, because the zero-total check runs only when payment data is imported. An API user with cart permissions can place an unpaid full-price order.","audience":"businesses","category":"package","nicknames":[],"who_cares":["magento","openmage","self-hosted","e-commerce"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker places unpaid full-price orders through the store API","analyst_note":"","how_to_check":"- Check the installed magento-lts version: `composer show openmage/magento-lts` or the version shown in the admin footer.\n- Confirm whether API users have cart permissions (cart_payment.method, cart_coupon.remove, cart.order) in the API role configuration.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-api-cart-access","patched-version"],"who_is_affected":"Stores running OpenMage magento-lts 20.x before 20.18.2 or 21.0.0-beta1 through beta2 that expose the SOAP/REST API to users with cart permissions. Stores without API access for customers or integrations, or with only trusted admin users on the API, are less exposed. The sources do not say whether the default configuration allows cart API access.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000766,"input_tokens":4671,"output_tokens":597,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-128032':18A,21A '-2026':17A,20A '20.18.2':79C '21.0.0':81C,84C 'accept':8A,35B,86C 'api':15A,61B,117C 'beta1':82C 'beta3':85C 'cart':64B,120C 'cart.order':138C 'cart_coupon.remove':135C 'cart_payment.method':126C 'check':52B,108C 'commerc':24B 'cve':16A,19A 'data':57B,113C 'e':23B 'e-commerc':22B 'free':5A,37B,88C,124C 'full':11A,71B,144C 'full-pric':10A,70B,143C 'host':30B 'import':59B,115C 'inform':91C 'lts':4A,34B,77C 'magento':3A,25B,33B,76C 'magento-lt':2A,32B,75C 'method':7A,39B,94C 'non':100C 'non-zero':99C 'openmag':1A,26B,31B,74C 'order':13A,41B,73B,96C,146C 'packag':27B 'payment':6A,38B,56B,90C,93C,112C 'permiss':65B,121C 'place':67B,140C 'price':12A,72B,145C 'rais':132C 'requir':92C 'run':53B,109C 'select':123C 'self':29B 'self-host':28B 'submit':137C 'total':43B,51B,102C,107C,129C 'unpaid':9A,69B,142C 'user':62B,118C 'via':14A,125C 'whose':42B 'zero':46B,50B,101C,106C,131C 'zero-tot':49B,105C","nicknames":[],"mitigations":[],"who_affected":"Stores running OpenMage magento-lts 20.x before 20.18.2 or 21.0.0-beta1 through beta2 that expose the SOAP/REST API to users with cart permissions. Stores without API access for customers or integrations, or with only trusted admin users on the API, are less exposed. The sources do not say whether the default configuration allows cart API access.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ecommerce","magento","medium","openmage","package","selfhosted"],"campaign_type":null,"search_a":"'-128032':18A,21A '-2026':17A,20A 'accept':8A 'api':15A 'cve':16A,19A 'free':5A 'full':11A 'full-pric':10A 'lts':4A 'magento':3A 'magento-lt':2A 'method':7A 'openmag':1A 'order':13A 'payment':6A 'price':12A 'unpaid':9A 'via':14A","search_b":"'accept':35B 'api':61B 'cart':64B 'check':52B 'commerc':24B 'data':57B 'e':23B 'e-commerc':22B 'free':37B 'full':71B 'full-pric':70B 'host':30B 'import':59B 'lts':34B 'magento':25B,33B 'magento-lt':32B 'method':39B 'openmag':26B,31B 'order':41B,73B 'packag':27B 'payment':38B,56B 'permiss':65B 'place':67B 'price':72B 'run':53B 'self':29B 'self-host':28B 'total':43B,51B 'unpaid':69B 'user':62B 'whose':42B 'zero':46B,50B 'zero-tot':49B","search_c":"'20.18.2':79C '21.0.0':81C,84C 'accept':86C 'api':117C 'beta1':82C 'beta3':85C 'cart':120C 'cart.order':138C 'cart_coupon.remove':135C 'cart_payment.method':126C 'check':108C 'data':113C 'free':88C,124C 'full':144C 'full-pric':143C 'import':115C 'inform':91C 'lts':77C 'magento':76C 'magento-lt':75C 'method':94C 'non':100C 'non-zero':99C 'openmag':74C 'order':96C,146C 'payment':90C,93C,112C 'permiss':121C 'place':140C 'price':145C 'rais':132C 'requir':92C 'run':109C 'select':123C 'submit':137C 'total':102C,107C,129C 'unpaid':142C 'user':118C 'via':125C 'zero':101C,106C,131C 'zero-tot':105C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-26T19:59:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128032","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128032","severity":null,"published_at":"2026-11-13T10:18:09+00:00","modified_at":"2026-11-13T10:18:09+00:00","first_seen_at":"2026-11-13T10:47:31+00:00","fetched_at":"2026-11-13T10:47:31+00:00","note":null}],"documents":[{"id":145372,"url":"https://github.com/OpenMage/magento-lts/commit/ae520e9197c4bf86d6e3b39fdded23958bf9d2d1","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145373,"url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-rmw8-7h79-p386","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T19:59:41+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145374,"url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-payment-bypass-via-free-payment-method","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}