Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| OpenMage | magento-lts | unaffected |
|
|||||||||
| OpenMage | magento-lts | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Fri, 13 Nov 2026 09:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an information disclosure vulnerability in Mage_Rss_Model_Resource_Order::getAllCommentCollection(), which omits the is_visible_on_front filter for invoice, shipment and credit-memo comments. Authenticated customers can open the /rss/order/status feed for their order to read internal staff comments, such as fraud-review and payment notes. | |
| Title | OpenMage magento-lts before 20.18.2 Information Disclosure via Order-Status RSS Feed | |
| Weaknesses | CWE-200 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-11-13T09:33:59.025Z
Reserved: 2026-11-12T20:33:43.125Z
Link: CVE-2026-128033
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-11-13T10:18:09.410
Modified: 2026-11-13T15:45:24.843
Link: CVE-2026-128033
Redhat
No data.
OpenCVE Enrichment
No data.