CVE-2026-40098 Details
Description
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the shared wishlist add-to-cart endpoint authorizes access with a public `sharing_code`, but loads the acted-on wishlist item by a separate global `wishlist_item_id` and never verifies that the item belongs to the shared wishlist referenced by that code. This lets an attacker use a valid shared wishlist code for wishlist A and a wishlist item ID belonging to victim wishlist B to import victim item B into the attacker's cart through the shared wishlist flow for wishlist A. Because the victim item's stored `buyRequest` is reused during cart import, the victim's private custom-option data is copied into the attacker's quote. If the product uses a file custom option, this can be elevated to cross-user file disclosure because the imported file metadata is preserved and the download endpoint is not ownership-bound. Version 20.17.0 patches the issue.
A vulnerability in OpenMage Magento Long Term Support (LTS) versions through 20.16.0 allows for cross-user wishlist item imports, leading to unauthorized access to private custom option data and a potential file disclosure. The issue arises in the shared wishlist add-to-cart endpoint, which verifies access using a public sharing code but fails to ensure that the wishlist item belongs to the referenced shared wishlist. This flaw enables an attacker to exploit valid shared wishlist codes and item IDs from other users' wishlists to import items into their own cart, along with sensitive custom option data. If the imported item includes a file custom option, this could result in cross-user file disclosure, as the metadata for the file option is preserved and can be accessed through the download endpoint, which does not verify ownership.
To address this vulnerability, update to OpenMage Magento LTS version 20.17.0 or later. After updating, ensure that the shared wishlist add-to-cart endpoint properly verifies that the wishlist item belongs to the shared wishlist referenced by the sharing code before allowing the import.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/OpenMage/magento-lts/security/advisories/GHSA-665x-ppc4-685w | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openmage magento | < 20.17.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 23, 2026 | Initial Analysis | [email protected] |
| Apr 20, 2026 | New CVE Received | [email protected] |