---
id: "CVE-2026-128040"
page: "https://infrastack.ai/live/CVE-2026-128040"
kind: "vulnerability"
aliases: ["CVE-2026-128040"]
title: "OpenMage magento-lts: stored XSS in admin pages runs script for other admins"
severity: "high"
cvss: 8.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["magento-lts", "openmage", "package", "php", "self-hosted"]
not_affected_if: ["already-on-fixed-version", "no-admin-accounts-beyond-owner"]
published_at: "2026-11-13T10:18:09+00:00"
first_seen_at: "2026-11-13T10:47:32+00:00"
updated_at: "2026-11-13T10:51:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-128040", "first_seen_at": "2026-11-13T10:47:32+00:00"}]
exploit_sources: []
---

# OpenMage magento-lts: stored XSS in admin pages runs script for other admins

Link for people: https://infrastack.ai/live/CVE-2026-128040 (this .md is for agents)

OpenMage magento-lts admin pages render Dataflow profile link variables, tax rate titles, OAuth consumer names and PayPal certificate filenames without escaping. A restricted administrator can store script that runs when a full administrator opens the page, letting it read the form key and act with that admin's privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed magento-lts version in composer.json or the OpenMage package lock and compare it with the fixed versions below
- Review which admin roles exist and whether any are restricted to a single area, since those are the accounts that can store the payload

## Fix

- magento-lts: upgrade to `20.18.2` or later on the 20.x line
- magento-lts: upgrade to `21.0.0-beta3` or later on the 21.0.0 beta line

## Timeline

- 2026-11-13T10:47:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-128040

## Documents

- [advisory] Vendor advisory: github.com https://github.com/OpenMage/magento-lts/security/advisories/GHSA-m858-x59w-rmp5
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-admin-dataflow-tax-oauth-paypal-fields
- [fix] Patch: github.com https://github.com/OpenMage/magento-lts/commit/62d2885fa6e7a4454e3a5c7765a6a5ca0085ecc1
- [fix] Patch: github.com https://github.com/OpenMage/magento-lts/commit/7f7a9deaac11fd2437bb1f8065db152a4b620609
- [fix] Patch: github.com https://github.com/OpenMage/magento-lts/commit/d10314ddda9a6081bc27370b463b5f77c2e499de
- [fix] Patch: github.com https://github.com/OpenMage/magento-lts/commit/e97e257b8f8d74d2e52dbf28caa211c262ff26be

## From the sources

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because admin pages render Dataflow profile link variables, tax rate titles, OAuth consumer names, and PayPal certificate filenames without escaping. An administrator restricted to one affected area can store script that runs when another administrator, including a full administrator, opens the page, reading the form key and performing actions with that administrator's privileges.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_