CVE-2026-128045

CVSS 6.9 (medium) · published 2026-11-13

OpenMage Magento-LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an authorization bypass in the /rss/order/status feed because its URL key is unsigned Base64-encoded JSON of the order, increment, and customer ids. Unauthenticated attackers can forge keys from enumerated sequential ids to read other customers' names, items, prices, totals, and status comments when order-status RSS is enabled.

Weakness: CWE-639

Source: NVD CVE-2026-128045

References

• https://github.com/OpenMage/magento-lts/commit/fde2d109292944d705c4035d87df055b1e945ea3
• https://github.com/OpenMage/magento-lts/security/advisories/GHSA-3hh8-xg45-mwrr
• https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-authorization-bypass-via-forgeable-rss-order-key

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.