MAGENTO-LTS · CVE-2026-128033 · Package
NO FIX YET · SEE WHAT TO DO
OpenMage magento-lts omits the front-visibility filter on invoice, shipment and credit-memo comments in its order status RSS feed. A logged-in customer can read internal staff notes such as fraud-review and payment remarks for their own orders.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Stores running OpenMage magento-lts before 20.18.2, or 21.0.0-beta1 through beta2, where customers can log in and use the order RSS feed. The exposure is limited to logged-in customers reading comments on their own orders. Stores on fixed versions or with the RSS order feed disabled can skip it.
Not affected if fixed-version, rss-disabled
Who cares magento-lts, openmage, php, self-hosted
composer.lock or the app/etc/local.xml install./rss/order/status for logged-in customers.20.18.2 on the 20.x line.21.0.0-beta3 on the 21.0 beta line.OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an information disclosure vulnerability in Mage_Rss_Model_Resource_Order::getAllCommentCollection(), which omits the is_visible_on_front filter for invoice, shipment and credit-memo comments. Authenticated customers can open the /rss/order/status feed for their order to read internal staff comments, such as fraud-review and payment notes.
This page as .md ·
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.