CVE-2026-128040 · Package
NO FIX YET · SEE WHAT TO DO
OpenMage magento-lts admin pages render Dataflow profile link variables, tax rate titles, OAuth consumer names and PayPal certificate filenames without escaping. A restricted administrator can store script that runs when a full administrator opens the page, letting it read the form key and act with that admin's privileges.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running OpenMage magento-lts (the Magento 1 community fork) before the fixed versions. Exposure needs an admin account with restricted access to store the payload, and a second admin to open the page. Stores with no restricted admin roles and no shared admin use carry less risk, but the flaw is in the core admin code so the fix should still be applied.
Not affected if already-on-fixed-version, no-admin-accounts-beyond-owner
Who cares magento-lts, openmage, php, self-hosted
20.18.2 or later on the 20.x line21.0.0-beta3 or later on the 21.0.0 beta lineOpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because admin pages render Dataflow profile link variables, tax rate titles, OAuth consumer names, and PayPal certificate filenames without escaping. An administrator restricted to one affected area can store script that runs when another administrator, including a full administrator, opens the page, reading the form key and performing actions with that administrator's privileges.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.