CVE-2026-128040
Received Received - Intake

Stored XSS in OpenMage Magento-LTS Admin Pages

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because admin pages render Dataflow profile link variables, tax rate titles, OAuth consumer names, and PayPal certificate filenames without escaping. An administrator restricted to one affected area can store script that runs when another administrator, including a full administrator, opens the page, reading the form key and performing actions with that administrator's privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128040
EUVD
EUVD-2026-125068

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
openmage magento_lts to 20.18.2 (exc)
openmage magento_lts to 21.0.0-beta3 (exc)
openmage magento_lts From 21.0.0-beta1 (inc) to 21.0.0-beta3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-128040 is a stored cross-site scripting (XSS) vulnerability in OpenMage Magento-LTS. It allows an administrator with limited privileges to inject malicious scripts into admin interfaces like Dataflow profiles, tax rates, OAuth consumers, and PayPal certificates. These scripts execute when other administrators view the affected pages, potentially stealing form keys and performing actions with elevated privileges.

Detection Guidance

Check OpenMage Magento-LTS versions before 20.18.2 or 21.0.0-beta1 to 21.0.0-beta2. Review admin interfaces for Dataflow profiles, tax rates, OAuth consumers, and PayPal certificates for suspicious scripts. Inspect error messages in Dataflow imports for unescaped HTML. Use admin panel access logs to track unauthorized actions.

Impact Analysis

An attacker could steal an administrator's session, perform unauthorized actions, or escalate privileges. This includes accessing sensitive data, modifying configurations, or taking control of the entire system if a full administrator is compromised.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade to patched versions 20.18.2, 20.19.0, or 21.0.0-beta3. Restrict access to ACL resources for affected areas. Manually review stored values in tax rates, OAuth consumers, and PayPal certificates for malicious content. Disable the 'Display Full Tax Summary' setting if enabled.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128040. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...