Insufficient Session Expiration in magento-lts - #VU158613
Published: November 2, 2026
Vulnerability identifier: #VU158613
CSH Severity: Low
CVSS v4: 7.4 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-613
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to retain revoked API access and continue reading and modifying data permitted by the user's existing role.
The vulnerability exists due to insufficient session expiration in the legacy Mage_Api session handling when resuming existing sessions after API user deactivation or API key changes. A remote privileged user can submit requests using a previously valid session ID to continue accessing the API with the user's existing permissions despite revocation.
Access can persist indefinitely if the client makes at least one API call within each idle timeout window.
Affected software
magento-lts
Remediation
Install security update from vendor's website.
magento-lts - addressed in versions 20.18.2, 20.19.0, 21.0.0 beta3