{"id":"CVE-2026-128045","kind":"vulnerability","aliases":["CVE-2026-128045"],"related":[],"title":"OpenMage Magento-LTS: forged RSS keys expose other customers' order details","description":"OpenMage Magento-LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an authorization bypass in the /rss/order/status feed because its URL key is unsigned Base64-encoded JSON of the order, increment, and customer ids. Unauthenticated attackers can forge keys from enumerated sequential ids to read other customers' names, items, prices, totals, and status comments when order-status RSS is enabled.","summary":"OpenMage Magento-LTS builds its order-status RSS feed URL key from unsigned Base64 JSON of order and customer ids. An unauthenticated attacker can forge keys from sequential ids and read other customers' names, items, prices, totals and status comments when order-status RSS is enabled.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","magento","magento-lts","openmage","package","php"],"not_affected_if":["fixed-version","rss-disabled"],"how_to_check":"- Check the installed version of Magento-LTS (OpenMage) against the fixed versions below.\n- Check whether order-status RSS is enabled in the store configuration for the RSS order status feed.\n- Check whether requests to `/rss/order/status` are reachable from the internet.","fix":"- Magento-LTS (OpenMage) before `20.18.2`: move to `20.18.2` or later.\n- 21.x before `21.0.0-beta3`: move to `21.0.0-beta3` or later.","status":"open","published_at":"2026-11-13T10:18:10+00:00","first_seen_at":"2026-11-13T10:47:32+00:00","triaged_at":"2026-11-13T10:54:35+00:00","updated_at":"2026-11-13T10:54:35+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T10:54:35Z","model":"claude-haiku-5-5","output":{"fix":"- Magento-LTS (OpenMage) before `20.18.2`: move to `20.18.2` or later.\n- 21.x before `21.0.0-beta3`: move to `21.0.0-beta3` or later.","reach":"internet","title":"OpenMage Magento-LTS: forged RSS keys expose other customers' order details","impact":"medium","summary":"OpenMage Magento-LTS builds its order-status RSS feed URL key from unsigned Base64 JSON of order and customer ids. An unauthenticated attacker can forge keys from sequential ids and read other customers' names, items, prices, totals and status comments when order-status RSS is enabled.","audience":"businesses","category":"package","nicknames":[],"who_cares":["magento","openmage","magento-lts","ecommerce","php"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Other customers' order details readable without any login","analyst_note":"","how_to_check":"- Check the installed version of Magento-LTS (OpenMage) against the fixed versions below.\n- Check whether order-status RSS is enabled in the store configuration for the RSS order status feed.\n- Check whether requests to `/rss/order/status` are reachable from the internet.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-version","rss-disabled"],"who_is_affected":"Stores running OpenMage Magento-LTS below the fixed versions with the order-status RSS feed enabled are exposed, since the feed key can be forged from sequential order and customer ids. Installations with the feed disabled, or with a fixed version, are not affected by this flaw.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000779,"input_tokens":4678,"output_tokens":622,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-128045':15A,18A '-2026':14A,17A '/rss/order/status':94C '20.18.2':81C '21.0.0':83C,86C 'attack':51B,114C 'author':90C 'base64':42B,103C 'base64-encoded':102C 'beta1':84C 'beta3':87C 'build':31B 'bypass':91C 'comment':68B,132C 'contain':88C 'custom':10A,47B,61B,111C,125C 'cve':13A,16A 'detail':12A 'ecommerc':19B 'enabl':75B,139C 'encod':104C 'enumer':119C 'expos':8A 'feed':37B,95C 'forg':5A,53B,116C 'id':48B,57B,112C,121C 'increment':109C 'item':63B,127C 'json':43B,105C 'key':7A,39B,54B,99C,117C 'lts':4A,23B,30B,79C 'magento':3A,20B,22B,29B,78C 'magento-lt':2A,21B,28B,77C 'name':62B,126C 'openmag':1A,24B,27B,76C 'order':11A,34B,45B,71B,108C,135C 'order-status':33B,70B,134C 'packag':25B 'php':26B 'price':64B,128C 'read':59B,123C 'rss':6A,36B,73B,137C 'sequenti':56B,120C 'status':35B,67B,72B,131C,136C 'total':65B,129C 'unauthent':50B,113C 'unsign':41B,101C 'url':38B,98C","nicknames":[],"mitigations":[],"who_affected":"Stores running OpenMage Magento-LTS below the fixed versions with the order-status RSS feed enabled are exposed, since the feed key can be forged from sequential order and customer ids. Installations with the feed disabled, or with a fixed version, are not affected by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ecommerce","magento","magentolts","medium","openmage","package","php"],"campaign_type":null,"search_a":"'-128045':15A,18A '-2026':14A,17A 'custom':10A 'cve':13A,16A 'detail':12A 'expos':8A 'forg':5A 'key':7A 'lts':4A 'magento':3A 'magento-lt':2A 'openmag':1A 'order':11A 'rss':6A","search_b":"'attack':51B 'base64':42B 'build':31B 'comment':68B 'custom':47B,61B 'ecommerc':19B 'enabl':75B 'feed':37B 'forg':53B 'id':48B,57B 'item':63B 'json':43B 'key':39B,54B 'lts':23B,30B 'magento':20B,22B,29B 'magento-lt':21B,28B 'name':62B 'openmag':24B,27B 'order':34B,45B,71B 'order-status':33B,70B 'packag':25B 'php':26B 'price':64B 'read':59B 'rss':36B,73B 'sequenti':56B 'status':35B,67B,72B 'total':65B 'unauthent':50B 'unsign':41B 'url':38B","search_c":"'/rss/order/status':94C '20.18.2':81C '21.0.0':83C,86C 'attack':114C 'author':90C 'base64':103C 'base64-encoded':102C 'beta1':84C 'beta3':87C 'bypass':91C 'comment':132C 'contain':88C 'custom':111C,125C 'enabl':139C 'encod':104C 'enumer':119C 'feed':95C 'forg':116C 'id':112C,121C 'increment':109C 'item':127C 'json':105C 'key':99C,117C 'lts':79C 'magento':78C 'magento-lt':77C 'name':126C 'openmag':76C 'order':108C,135C 'order-status':134C 'price':128C 'read':123C 'rss':137C 'sequenti':120C 'status':131C,136C 'total':129C 'unauthent':113C 'unsign':101C 'url':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-26T19:59:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128045","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128045","severity":null,"published_at":"2026-11-13T10:18:10+00:00","modified_at":"2026-11-13T10:18:10+00:00","first_seen_at":"2026-11-13T10:47:32+00:00","fetched_at":"2026-11-13T10:47:32+00:00","note":null}],"documents":[{"id":145396,"url":"https://github.com/OpenMage/magento-lts/commit/fde2d109292944d705c4035d87df055b1e945ea3","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145397,"url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-3hh8-xg45-mwrr","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T19:59:12+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145398,"url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-authorization-bypass-via-forgeable-rss-order-key","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}