CVE-2026-40098
OpenMage LTS imports cross-user wishlist item via shared wishlist code, leading to private option disclosure and file-disclosure variant
Description
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the shared wishlist add-to-cart endpoint authorizes access with a public `sharing_code`, but loads the acted-on wishlist item by a separate global `wishlist_item_id` and never verifies that the item belongs to the shared wishlist referenced by that code. This lets an attacker use a valid shared wishlist code for wishlist A and a wishlist item ID belonging to victim wishlist B to import victim item B into the attacker's cart through the shared wishlist flow for wishlist A. Because the victim item's stored `buyRequest` is reused during cart import, the victim's private custom-option data is copied into the attacker's quote. If the product uses a file custom option, this can be elevated to cross-user file disclosure because the imported file metadata is preserved and the download endpoint is not ownership-bound. Version 20.17.0 patches the issue.
INFO
Published Date :
April 20, 2026, 5:16 p.m.
Last Modified :
Oct. 26, 2026, 10:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | [email protected] | ||||
| CVSS 4.0 | MEDIUM | [email protected] |
Solution
- Update Magento LTS to version 20.17.0.
- Verify access controls on shared wishlist endpoints.
- Review file upload and download security.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-40098.
| URL | Resource |
|---|---|
| https://github.com/OpenMage/magento-lts/security/advisories/GHSA-665x-ppc4-685w | Exploit Mitigation Vendor Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-40098 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-40098
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-40098 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-40098 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 26, 2026
Action Type Old Value New Value Added Translation Title: magento-lts de OpenMage, Description: Magento Long Term Support (LTS) es un proyecto no oficial, impulsado por la comunidad, que proporciona una alternativa a la plataforma de comercio electrónico Magento Community Edition con un alto nivel de compatibilidad con versiones anteriores. Antes de la versión 20.17.0, el endpoint de añadir al carrito de la lista de deseos compartida autoriza el acceso con un ’sharing_code’ público, pero carga el artículo de la lista de deseos sobre el que se actúa mediante un ’wishlist_item_id’ global separado y nunca verifica que el artículo pertenezca a la lista de deseos compartida referenciada por ese código. Esto permite a un atacante usar un código de lista de deseos compartida válido para la lista de deseos A y un ID de artículo de lista de deseos perteneciente a la lista de deseos de la víctima B para importar el artículo de la víctima B al carrito del atacante a través del flujo de lista de deseos compartida para la lista de deseos A. Debido a que el ’buyRequest’ almacenado del artículo de la víctima se reutiliza durante la importación al carrito, los datos privados de opciones personalizadas de la víctima se copian en la cotización del atacante. Si el producto utiliza una opción personalizada de archivo, esto puede elevarse a una divulgación de archivos entre usuarios porque los metadatos del archivo importado se conservan y el endpoint de descarga no está vinculado a la propiedad. La versión 20.17.0 parchea el problema. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'OpenMage', 'product': 'magento-lts', 'versions': [{'status': 'affected', 'version': '< 20.17.0'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-40098', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-04-20T18:10:34.344692Z'} -
Initial Analysis by [email protected]
Apr. 23, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Added CPE Configuration OR *cpe:2.3:a:openmage:magento:*:*:*:*:lts:*:*:* versions up to (excluding) 20.17.0 Added Reference Type GitHub, Inc.: https://github.com/OpenMage/magento-lts/security/advisories/GHSA-665x-ppc4-685w Types: Exploit, Mitigation, Vendor Advisory -
New CVE Received by [email protected]
Apr. 20, 2026
Action Type Old Value New Value Added Description Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the shared wishlist add-to-cart endpoint authorizes access with a public `sharing_code`, but loads the acted-on wishlist item by a separate global `wishlist_item_id` and never verifies that the item belongs to the shared wishlist referenced by that code. This lets an attacker use a valid shared wishlist code for wishlist A and a wishlist item ID belonging to victim wishlist B to import victim item B into the attacker's cart through the shared wishlist flow for wishlist A. Because the victim item's stored `buyRequest` is reused during cart import, the victim's private custom-option data is copied into the attacker's quote. If the product uses a file custom option, this can be elevated to cross-user file disclosure because the imported file metadata is preserved and the download endpoint is not ownership-bound. Version 20.17.0 patches the issue. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-862 Added Reference https://github.com/OpenMage/magento-lts/security/advisories/GHSA-665x-ppc4-685w