{"id":"CVE-2026-128040","kind":"vulnerability","aliases":["CVE-2026-128040"],"related":[],"title":"OpenMage magento-lts: stored XSS in admin pages runs script for other admins","description":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because admin pages render Dataflow profile link variables, tax rate titles, OAuth consumer names, and PayPal certificate filenames without escaping. An administrator restricted to one affected area can store script that runs when another administrator, including a full administrator, opens the page, reading the form key and performing actions with that administrator's privileges.","summary":"OpenMage magento-lts admin pages render Dataflow profile link variables, tax rate titles, OAuth consumer names and PayPal certificate filenames without escaping. A restricted administrator can store script that runs when a full administrator opens the page, letting it read the form key and act with that admin's privileges.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["magento-lts","openmage","package","php","self-hosted"],"not_affected_if":["already-on-fixed-version","no-admin-accounts-beyond-owner"],"how_to_check":"- Check the installed magento-lts version in composer.json or the OpenMage package lock and compare it with the fixed versions below\n- Review which admin roles exist and whether any are restricted to a single area, since those are the accounts that can store the payload","fix":"- magento-lts: upgrade to `20.18.2` or later on the 20.x line\n- magento-lts: upgrade to `21.0.0-beta3` or later on the 21.0.0 beta line","status":"open","published_at":"2026-11-13T10:18:09+00:00","first_seen_at":"2026-11-13T10:47:32+00:00","triaged_at":"2026-11-13T10:51:00+00:00","updated_at":"2026-11-13T10:51:00+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T10:51:00Z","model":"claude-haiku-5-5","output":{"fix":"- magento-lts: upgrade to `20.18.2` or later on the 20.x line\n- magento-lts: upgrade to `21.0.0-beta3` or later on the 21.0.0 beta line","reach":"internet","title":"OpenMage magento-lts: stored XSS in admin pages runs script for other admins","impact":"high","summary":"OpenMage magento-lts admin pages render Dataflow profile link variables, tax rate titles, OAuth consumer names and PayPal certificate filenames without escaping. A restricted administrator can store script that runs when a full administrator opens the page, letting it read the form key and act with that admin's privileges.","audience":"businesses","category":"package","nicknames":[],"who_cares":["magento-lts","openmage","php","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Admin session takeover and actions with full administrator privileges.","analyst_note":"Entry is fairly complete; the vendor advisory and VulnCheck page could confirm exact fixed versions and whether non-admin users are involved.","how_to_check":"- Check the installed magento-lts version in composer.json or the OpenMage package lock and compare it with the fixed versions below\n- Review which admin roles exist and whether any are restricted to a single area, since those are the accounts that can store the payload","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["already-on-fixed-version","no-admin-accounts-beyond-owner"],"who_is_affected":"Sites running OpenMage magento-lts (the Magento 1 community fork) before the fixed versions. Exposure needs an admin account with restricted access to store the payload, and a second admin to open the page. Stores with no restricted admin roles and no shared admin use carry less risk, but the flaw is in the core admin code so the fix should still be applied.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000809,"input_tokens":4725,"output_tokens":673,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-128040':17A,20A '-2026':16A,19A '20.18.2':86C '21.0.0':88C,91C 'act':75B 'action':149C 'admin':8A,14A,34B,78B,102C 'administr':55B,64B,122C,135C,139C,152C 'affect':126C 'anoth':134C 'area':127C 'beta1':89C 'beta3':92C 'certif':49B,117C 'consum':45B,113C 'contain':93C 'cross':97C 'cross-sit':96C 'cve':15A,18A 'dataflow':37B,105C 'escap':52B,120C 'filenam':50B,118C 'form':72B,145C 'full':63B,138C 'host':29B 'includ':136C 'key':73B,146C 'let':68B 'link':39B,107C 'lts':4A,23B,33B,84C 'magento':3A,22B,32B,83C 'magento-lt':2A,21B,31B,82C 'name':46B,114C 'oauth':44B,112C 'one':125C 'open':65B,140C 'openmag':1A,24B,30B,81C 'packag':25B 'page':9A,35B,67B,103C,142C 'paypal':48B,116C 'perform':148C 'php':26B 'privileg':80B,154C 'profil':38B,106C 'rate':42B,110C 'read':70B,143C 'render':36B,104C 'restrict':54B,123C 'run':10A,60B,132C 'script':11A,58B,99C,130C 'self':28B 'self-host':27B 'site':98C 'store':5A,57B,95C,129C 'tax':41B,109C 'titl':43B,111C 'variabl':40B,108C 'vulner':100C 'without':51B,119C 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Sites running OpenMage magento-lts (the Magento 1 community fork) before the fixed versions. Exposure needs an admin account with restricted access to store the payload, and a second admin to open the page. Stores with no restricted admin roles and no shared admin use carry less risk, but the flaw is in the core admin code so the fix should still be applied.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","magentolts","openmage","package","php","selfhosted"],"campaign_type":null,"search_a":"'-128040':17A,20A '-2026':16A,19A 'admin':8A,14A 'cve':15A,18A 'lts':4A 'magento':3A 'magento-lt':2A 'openmag':1A 'page':9A 'run':10A 'script':11A 'store':5A 'xss':6A","search_b":"'act':75B 'admin':34B,78B 'administr':55B,64B 'certif':49B 'consum':45B 'dataflow':37B 'escap':52B 'filenam':50B 'form':72B 'full':63B 'host':29B 'key':73B 'let':68B 'link':39B 'lts':23B,33B 'magento':22B,32B 'magento-lt':21B,31B 'name':46B 'oauth':44B 'open':65B 'openmag':24B,30B 'packag':25B 'page':35B,67B 'paypal':48B 'php':26B 'privileg':80B 'profil':38B 'rate':42B 'read':70B 'render':36B 'restrict':54B 'run':60B 'script':58B 'self':28B 'self-host':27B 'store':57B 'tax':41B 'titl':43B 'variabl':40B 'without':51B","search_c":"'20.18.2':86C '21.0.0':88C,91C 'action':149C 'admin':102C 'administr':122C,135C,139C,152C 'affect':126C 'anoth':134C 'area':127C 'beta1':89C 'beta3':92C 'certif':117C 'consum':113C 'contain':93C 'cross':97C 'cross-sit':96C 'dataflow':105C 'escap':120C 'filenam':118C 'form':145C 'full':138C 'includ':136C 'key':146C 'link':107C 'lts':84C 'magento':83C 'magento-lt':82C 'name':114C 'oauth':112C 'one':125C 'open':140C 'openmag':81C 'page':103C,142C 'paypal':116C 'perform':148C 'privileg':154C 'profil':106C 'rate':110C 'read':143C 'render':104C 'restrict':123C 'run':132C 'script':99C,130C 'site':98C 'store':95C,129C 'tax':109C 'titl':111C 'variabl':108C 'vulner':100C 'without':119C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-26T19:59:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128040","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128040","severity":null,"published_at":"2026-11-13T10:18:09+00:00","modified_at":"2026-11-13T10:18:09+00:00","first_seen_at":"2026-11-13T10:47:32+00:00","fetched_at":"2026-11-13T10:47:32+00:00","note":null}],"documents":[{"id":145378,"url":"https://github.com/OpenMage/magento-lts/commit/62d2885fa6e7a4454e3a5c7765a6a5ca0085ecc1","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145379,"url":"https://github.com/OpenMage/magento-lts/commit/7f7a9deaac11fd2437bb1f8065db152a4b620609","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145361,"url":"https://github.com/OpenMage/magento-lts/commit/d10314ddda9a6081bc27370b463b5f77c2e499de","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145381,"url":"https://github.com/OpenMage/magento-lts/commit/e97e257b8f8d74d2e52dbf28caa211c262ff26be","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145382,"url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-m858-x59w-rmp5","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T19:59:39+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145383,"url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-admin-dataflow-tax-oauth-paypal-fields","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}