CVE-2026-128048 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenMage magento-lts lets an administrator with Transactional Emails access preview a crafted email template that exposes decrypted configuration secrets. The exposed values include PayPal, payment gateway, and carrier credentials.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Stores running magento-lts before 20.18.2, or 21.0.0-beta1 before 21.0.0-beta3. Exposure requires an administrator account with Transactional Emails access, which a restricted admin role can hold. Stores without such roles or on fixed versions are not affected.
Not affected if fixed-version, no-transactional-email-access
Who cares magento-lts, php, self-hosted
20.18.2 and 21.0.0-beta3.20.18.2 or later on the 20.x line, or 21.0.0-beta3 or later on the 21.0 beta line.OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 lets restricted administrators read decrypted configuration secrets because the store.getConfig email template directive's encrypted-path check missed config.xml-declared paths, case variants of the getConfig method name, and parent paths. Administrators with Transactional Emails access can preview a crafted template to expose PayPal, payment gateway, and carrier credentials.
This page as .md ·
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.