SB2026110246 - Multiple vulnerabilities in magento-lts

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110246

SB2026110246 - Multiple vulnerabilities in magento-lts

Published: November 2, 2026

Security Bulletin ID SB2026110246
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 29
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 7% Low 93%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 29 vulnerabilities.


1) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to export shipping table-rate data without the required role permission.

The vulnerability exists due to incorrect authorization in the OpenMage system configuration table-rate export action when processing exports without enforcing access to the Shipping Methods section. A remote privileged user can request a table-rate export through broader configuration access to obtain data restricted by the role's section-specific permission.


2) Information Exposure Through an Error Message (CVE-ID: N/A)

CWE-ID: CWE-209 - Information Exposure Through an Error Message

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to disclose absolute server paths through error pages.

The vulnerability exists due to incomplete error handling in Mage_Adminhtml_Cms_WysiwygController::directiveAction() when filtering template directives on PHP 8, because the handler catches only Exception and allows Error, ValueError, and TypeError to reach the error page. A remote privileged user can submit directives that trigger these errors with CMS access to expose stack traces that may contain absolute server paths.


3) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to read image files outside the media directory.

The vulnerability exists due to path traversal in mediaDirective() when joining the supplied url parameter to the media directory without a containment check. A remote privileged user can submit a directive such as {{media url="../…"}} to the cms_wysiwyg/directive endpoint with CMS access to read image files outside media/ that the web server user can open.

Text resources such as configuration files and metadata JSON cannot be read back because GD rejects them.


4) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote privileged user to make server-side requests to arbitrary HTTP(S) URLs, including internal hosts, and read image responses.

The vulnerability exists due to insufficient restriction of server-side request destinations in Mage_Adminhtml_Cms_WysiwygController::directiveAction() when filtering the base64-decoded ___directive request parameter and passing the result to the GD image adapter. A remote privileged user can submit template directives such as {{protocol}} with CMS access to cause the server to fetch an attacker-chosen URL and return decodable image content.

Responses that GD cannot decode as images are replaced with a placeholder, making requests for other content blind.


5) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a customer's cart to be refilled from an order that the store does not permit to be reordered.

The vulnerability exists due to missing server-side authorization of reorder eligibility in Mage_Sales_Controller_Abstract::reorderAction() when processing reorder requests for orders that belong to the customer but are ineligible for reordering. A remote attacker can trick a logged-in customer into following a crafted reorder link to bypass the eligibility restriction enforced only by the templates and refill the customer's cart from an otherwise disallowed order.


6) Cross-site request forgery (CVE-ID: N/A)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to delete a customer's authorized OAuth applications or re-enable a previously revoked application without the customer's consent.

The vulnerability exists due to missing cross-site request forgery protection in Mage_Oauth_Customer_TokenController when handling OAuth application revocation and deletion requests. A remote attacker can trick a logged-in customer into loading attacker-controlled content that triggers a GET request to oauth/customer_token/revoke or oauth/customer_token/delete without form-key validation to delete an authorized application or re-enable a revoked application.

Exploitation requires the merchant to have enabled customer OAuth (REST) access.


7) Cross-site request forgery (CVE-ID: N/A)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cancel, suspend or activate a customer's recurring payment profile without the customer's consent.

The vulnerability exists due to missing cross-site request forgery protection in Mage_Sales_Recurring_ProfileController when handling recurring profile updates. A remote attacker can trick a logged-in customer into loading attacker-controlled content that triggers a GET request to sales/recurring_profile/updateState or sales/recurring_profile/updateProfile without form-key validation to change the state of a recurring payment profile belonging to that customer.

Exploitation requires the merchant to have enabled recurring profiles.


8) Cross-site request forgery (CVE-ID: N/A)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to change a customer's shopping cart contents without the customer's consent.

The vulnerability exists due to missing cross-site request forgery protection in Mage_Sales_Controller_Abstract::reorderAction() when handling reorder requests. A remote attacker can trick a logged-in customer into loading attacker-controlled content that triggers a GET request to sales/order/reorder or sales/guest/reorder without form-key validation to refill the customer's cart from a past order.


9) Cross-site request forgery (CVE-ID: N/A)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cancel a customer's billing agreement without the customer's consent.

The vulnerability exists due to missing cross-site request forgery protection in Mage_Sales_Billing_AgreementController::cancelAction() when handling billing agreement cancellation requests. A remote attacker can trick a logged-in customer into loading attacker-controlled content that triggers a GET request to sales/billing_agreement/cancel without form-key validation to cancel a billing agreement belonging to that customer.

Exploitation requires the merchant to have enabled billing agreements.


10) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to read internal staff comments on invoices, shipments and credit memos associated with their own orders.

The vulnerability exists due to missing storefront-visibility filtering in Mage_Rss_Model_Resource_Order::getAllCommentCollection() when building the customer order-status RSS feed. A remote user can open /rss/order/status through their order's feed link to read comments that staff marked as not visible on the storefront.

Both RSS and the Customer Order Status Notification feed must be enabled; the feed is disabled by default.


11) Interpretation Conflict (CVE-ID: N/A)

CWE-ID: CWE-436 - Interpretation Conflict

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to read and write arbitrary files as the web server user and execute arbitrary code on deployments where the document root is writable.

The vulnerability exists due to an interpretation conflict between namespace-aware XPath checks in Mage_Core_Model_Layout_Validator and namespace-insensitive element handling in Mage_Core_Model_Layout::generateBlocks() when processing custom layout XML. A remote privileged user can save a product layout update containing an action element with a default XML namespace and a helper attribute, then request the product page to bypass validation and invoke arbitrary helper methods, including a file-merge helper that reads and writes files as the web server user.


12) Improper Enforcement of Behavioral Workflow (CVE-ID: N/A)

CWE-ID: CWE-841 - Improper Enforcement of Behavioral Workflow

CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to place full-price orders without payment being collected, attempted, or authorized.

The vulnerability exists due to improper enforcement of the payment workflow in Mage_Payment_Model_Method_Free when order submission reuses a stored payment method without revalidating the cart total. A remote privileged user can use the SOAP/XML-RPC cart API to select the free payment method while the cart total is zero, increase the total by removing a 100%-off coupon or adding items, and submit the order without re-importing payment data to place a non-zero order without payment.

Stock storefront onepage checkout is not affected in practice because order submission fails before placement when payment data is omitted.


13) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to import or export tax rates without the required role permission.

The vulnerability exists due to incorrect authorization in the OpenMage tax rate import and export actions when handling requests without enforcing the dedicated tax-rate import/export permission. A remote privileged user can invoke these actions through broader tax administration access to read or change tax-rate data despite the role's denied permission.


14) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to save tax classes of a type outside the role's permitted scope.

The vulnerability exists due to incorrect authorization in the OpenMage tax class save action when processing a posted class type without enforcing that type's own permission. A remote privileged user can submit a tax class save request specifying a class type not authorized for the role to make unauthorized tax class changes.


15) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to use USPS administrative tools despite lacking the required shipping configuration permission.

The vulnerability exists due to incorrect authorization in the OpenMage system configuration USPS admin tools when handling tool actions without enforcing access to the Shipping Methods section. A remote privileged user can invoke these tools through broader configuration access to perform operations denied by the role's section-specific permission.


16) Arbitrary file upload (CVE-ID: N/A)

CWE-ID: CWE-434 - Unrestricted Upload of File with Dangerous Type

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary script in a victim's browser within the store's origin.

The vulnerability exists due to unrestricted upload of files with dangerous types in Mage_Catalog_Model_Product_Option_Type_File::_validateUploadedFile() when a product File custom option has an empty allowed-extension list and the web server serves media/custom_options/. A remote attacker can upload a crafted SVG, XHTML, or XML document and trick a victim into opening its URL to execute arbitrary script in the store's origin.


17) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to access REST attribute administration despite lacking its specific role permission.

The vulnerability exists due to incorrect authorization in the OpenMage REST attribute admin controller when checking the broader API ACL resource instead of the REST attributes resource. A remote privileged user can invoke REST attribute administration functions using broader API access to bypass the role's attribute-specific access restriction.


18) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to create, edit or delete REST roles despite role restrictions denying those actions.

The vulnerability exists due to incorrect authorization in the OpenMage REST role admin controller when handling role-management actions without enforcing their individual permissions. A remote privileged user can invoke creation, editing or deletion functions through broader ACL access to make unauthorized REST role changes, including creating and self-assigning a role with only the Delete permission.


19) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to access, edit or delete catalog tags despite role restrictions denying those operations.

The vulnerability exists due to incorrect authorization in the OpenMage catalog tag admin controller when handling the All Tags grid, edits and mass actions without enforcing the appropriate tag permission. A remote privileged user can invoke these functions through broader module access to view or modify tags outside the role's permitted scope.


20) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to access restricted report data, including customer names, email addresses and IP addresses.

The vulnerability exists due to incorrect authorization in the OpenMage report admin controllers when handling exports and detail pages without enforcing each report's specific permission. A remote privileged user can request restricted report exports or detail pages using broader module access to disclose data denied by the role's finer permissions.


21) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to edit existing orders despite lacking the order-edit permission.

The vulnerability exists due to incorrect authorization in the OpenMage order-edit controller when authorizing editing steps against the order-create permission instead of the order-edit permission. A remote privileged user can use a role granted order creation but denied order editing to modify existing orders without the required authorization.


22) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to access order-creation helper functions despite lacking the order-create permission.

The vulnerability exists due to incorrect authorization in the OpenMage order-creation controller when handling customer-grid, quote-building and configuration steps without enforcing the order-create permission. A remote privileged user can invoke these helper actions through broader module access to perform restricted order-creation operations.


23) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to download credit memo documents without the required role permission.

The vulnerability exists due to incorrect authorization in the OpenMage order credit memo PDF actions when generating documents without checking credit-memo access. A remote privileged user can request credit memo PDFs, including through the order grid's Print All action, to obtain documents denied by the role's finer permissions.


24) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to rewrite order shipping addresses despite role restrictions, potentially diverting shipments.

The vulnerability exists due to incorrect authorization in the OpenMage order-address editing actions when handling address edit and save requests without enforcing the order-edit permission. A remote privileged user can invoke these actions through an already accessible parent ACL resource to change order addresses without the required authorization.


25) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to void order payments without the required role permission.

The vulnerability exists due to incorrect authorization in the OpenMage sales order admin controller when handling payment-void actions without checking the finer invoice permission. A remote privileged user can invoke the void-payment action using access to the parent ACL resource to void payments despite the role's denied permission.


26) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to cancel, hold or unhold orders in bulk despite role restrictions denying those actions.

The vulnerability exists due to incorrect authorization in the OpenMage sales order admin controller when checking permissions for mass actions. A remote privileged user can submit mass cancellation, hold or unhold requests authorized against the parent ACL resource rather than the corresponding action permission to modify orders without the required authorization.


27) Insufficient Session Expiration (CVE-ID: N/A)

CWE-ID: CWE-613 - Insufficient Session Expiration

CVSSv4: 7.4 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to retain REST API access after admin account deactivation and continue reading and modifying data permitted by the user's existing REST role.

The vulnerability exists due to insufficient OAuth token invalidation and missing admin account status checks in Mage_Api2_Model_Auth_User_Admin::getRole() and Mage_Oauth_Model_Server::checkAccessRequest() when authorizing REST API requests. A remote privileged user can submit requests using an OAuth access token issued while the admin account was active to continue accessing the REST API after that account is deactivated.

The issue is restricted to admin REST access; customer REST access is unaffected, and deleting a customer or admin deletes its tokens.


28) Insufficient Session Expiration (CVE-ID: N/A)

CWE-ID: CWE-613 - Insufficient Session Expiration

CVSSv4: 7.4 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to retain revoked API access and continue reading and modifying data permitted by the user's existing role.

The vulnerability exists due to insufficient session expiration in the legacy Mage_Api session handling when resuming existing sessions after API user deactivation or API key changes. A remote privileged user can submit requests using a previously valid session ID to continue accessing the API with the user's existing permissions despite revocation.

Access can persist indefinitely if the client makes at least one API call within each idle timeout window.


29) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary script in an importing administrator's browser in the adminhtml origin.

The vulnerability exists due to improper escaping of batch import row error messages in the Dataflow profile runner's system/convert/profile/process.phtml template when rendering errors containing imported row values. A remote attacker can supply a crafted import file containing script-bearing markup in the store, type, or attribute_set columns and induce an administrator to run a Dataflow import profile on it to execute script with the importing administrator's session and form key.


Remediation

Install update from vendor's website.

References