CVE-2026-40098 OpenMage LTS: Cross-user wishlist import leads to private option & file disclosure

What is CVE-2026-40098?

CVE-2026-40098 is a medium-severity missing authorization vulnerability in OpenMage magento-lts, published on 20 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the shared wishlist add-to-cart endpoint authorizes access with a public `sharing_code`, but loads the acted-on wishlist item by a separate global `wishlist_item_id` and never verifies that the item belongs to the shared wishlist referenced by that code. This lets an attacker use a valid shared wishlist code for wishlist A and a wishlist item ID belonging to victim wishlist B to import victim item B into the attacker's cart through the shared wishlist flow for wishlist A. Because the victim item's stored `buyRequest` is reused during cart import, the victim's private custom-option data is copied into the attacker's quote. If the product uses a file custom option, this can be elevated to cross-user file disclosure because the imported file metadata is preserved and the download endpoint is not ownership-bound. Version 20.17.0 patches the issue.

Weakness: CWE-862

Which versions are affected by CVE-2026-40098?

2 open source packages ship an affected version, including openmage/magento-lts. It affects 1 product.

Products include Openmage Magento.

How do I fix CVE-2026-40098?

Upgrade openmage/magento-lts to 20.17.0 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-40098 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40098 exists.

Other vulnerabilities in OpenMage magento-lts

• CVE-2021-21426 Fixes a bug in Zend Framework's Stream HTTP Wrapper Critical 9.8
• CVE-2021-21427 Backport for CVE-2021-21024 Blind SQLi from Magento 2 Critical 9.1
• CVE-2021-41144 OpenMage LTS authenticated remote code execution through layout update High 8.8
• CVE-2026-40488 OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution High 8.7
• CVE-2026-25524 OpenMage LTS's Phar Deserialization leads to Remote Code Execution High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-665x-ppc4-685w.