CVE-2026-128045 · Package
NO FIX YET · SEE WHAT TO DO
OpenMage Magento-LTS builds its order-status RSS feed URL key from unsigned Base64 JSON of order and customer ids. An unauthenticated attacker can forge keys from sequential ids and read other customers' names, items, prices, totals and status comments when order-status RSS is enabled.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Stores running OpenMage Magento-LTS below the fixed versions with the order-status RSS feed enabled are exposed, since the feed key can be forged from sequential order and customer ids. Installations with the feed disabled, or with a fixed version, are not affected by this flaw.
Not affected if fixed-version, rss-disabled
Who cares ecommerce, magento, magento-lts, openmage, php
/rss/order/status are reachable from the internet.20.18.2: move to 20.18.2 or later.21.0.0-beta3: move to 21.0.0-beta3 or later.OpenMage Magento-LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an authorization bypass in the /rss/order/status feed because its URL key is unsigned Base64-encoded JSON of the order, increment, and customer ids. Unauthenticated attackers can forge keys from enumerated sequential ids to read other customers' names, items, prices, totals, and status comments when order-status RSS is enabled.
This page as .md ·
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.