CVE-2026-128032 | OpenMage magento-lts up to 20.18.1/21.0.0-beta2 Payment cart_payment.method/cart_coupon.remove/cart.order privileges management

A vulnerability, which was classified as problematic, has been found in OpenMage magento-lts up to 20.18.1/21.0.0-beta2. This affects an unknown part of the component Payment. The manipulation of the argument cart_payment.method/cart_coupon.remove/cart.order leads to improper privilege management.

This vulnerability is referenced as CVE-2026-128032. Remote exploitation of the attack is possible. No exploit is available.

It is advisable to upgrade the affected component.VulDB Recent EntriesRead More