CVE-2026-40098: Openmage Magento Info Disclosure Flaw

CVE-2026-40098 Overview

CVE-2026-40098 is an Insecure Direct Object Reference (IDOR) vulnerability affecting OpenMage Magento Long Term Support (LTS), an unofficial community-driven fork of the Magento Community Edition e-commerce platform. The vulnerability exists in the shared wishlist add-to-cart functionality, where the endpoint fails to properly verify that a wishlist item belongs to the shared wishlist being accessed. This authorization bypass allows attackers to access and import wishlist items from other users' private wishlists, potentially exposing sensitive custom-option data and uploaded files.

Critical Impact

Attackers can exploit this vulnerability to steal private wishlist item data from other users, including custom product options and uploaded files, leading to cross-user information disclosure on affected e-commerce platforms.

Affected Products

• OpenMage Magento LTS versions prior to 20.17.0
• Magento e-commerce installations using the OpenMage community fork
• Custom deployments with shared wishlist functionality enabled

Discovery Timeline

• 2026-04-20 - CVE CVE-2026-40098 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-40098

Vulnerability Analysis

The vulnerability stems from a missing authorization check in the shared wishlist add-to-cart endpoint. When a user shares a wishlist, a public sharing_code is generated to allow others to view and add items from that wishlist to their cart. However, the endpoint that handles adding items to the cart accepts two separate parameters: the sharing_code (which authorizes access to a shared wishlist) and a wishlist_item_id (which identifies the specific item to add).

The critical flaw is that the application validates the sharing_code to confirm the user has access to a shared wishlist, but then loads the wishlist item by its global wishlist_item_id without verifying that item actually belongs to the wishlist associated with the provided sharing code. This creates an authorization bypass where an attacker can reference any wishlist item ID in the system.

Root Cause

The root cause is classified as CWE-862 (Missing Authorization). The shared wishlist controller fails to implement proper ownership verification between the authenticated sharing code and the requested wishlist item. The authorization check only validates that the sharing code is valid and grants access to wishlist A, but does not enforce that the wishlist_item_id parameter corresponds to an item within wishlist A. This allows referencing item IDs from completely unrelated wishlists.

Attack Vector

The attack is network-based and can be executed by any authenticated user with low privileges. An attacker exploits this vulnerability through the following process:

1. The attacker obtains or creates a valid shared wishlist (wishlist A) with its corresponding sharing_code
2. The attacker identifies or enumerates victim wishlist item IDs belonging to other users' private wishlists (wishlist B)
3. The attacker crafts a request to the shared wishlist add-to-cart endpoint, providing the valid sharing_code for wishlist A but specifying a wishlist_item_id from the victim's wishlist B
4. The application validates the sharing code successfully but loads the victim's wishlist item without ownership verification
5. The victim's item, including its stored buyRequest containing private custom-option data, is imported into the attacker's shopping cart

If the victim's wishlist item includes a file custom option (such as an uploaded document for personalization), the attack can be elevated to cross-user file disclosure. The imported file metadata is preserved in the attacker's quote, and the file download endpoint does not perform ownership validation, allowing the attacker to download the victim's uploaded files.

Detection Methods for CVE-2026-40098

Indicators of Compromise

• Unusual patterns of wishlist item additions where the wishlist_item_id does not correspond to items within the shared wishlist referenced by the sharing_code
• Multiple failed or successful cart additions from the same user session targeting various sequential wishlist item IDs (indicating enumeration attempts)
• Access logs showing requests to the shared wishlist add-to-cart endpoint with mismatched wishlist and item references
• File download requests for wishlist-related files by users who do not own the associated wishlist items

Detection Strategies

• Implement application-layer logging that captures both the sharing_code and wishlist_item_id parameters for correlation analysis
• Deploy web application firewall (WAF) rules to detect parameter manipulation patterns indicative of IDOR attacks
• Create alerts for anomalous wishlist activity, such as a single user adding items from multiple different wishlists in rapid succession
• Monitor for sequential or patterned wishlist item ID access that suggests enumeration behavior

Monitoring Recommendations

• Enable detailed access logging for all wishlist-related endpoints, particularly the shared wishlist add-to-cart functionality
• Implement rate limiting on wishlist operations to slow enumeration attempts
• Review file download logs for the custom option file endpoint to identify potential unauthorized access
• Establish baseline metrics for normal wishlist sharing behavior to detect statistical anomalies

How to Mitigate CVE-2026-40098

Immediate Actions Required

• Upgrade OpenMage Magento LTS to version 20.17.0 or later immediately
• Audit recent wishlist activity logs for signs of exploitation or enumeration attempts
• Review any shared wishlists and associated file uploads for potential data exposure
• Consider temporarily disabling the shared wishlist feature if immediate patching is not possible

Patch Information

The vulnerability has been addressed in OpenMage Magento LTS version 20.17.0. The patch adds proper authorization checks to verify that the requested wishlist_item_id belongs to the wishlist associated with the provided sharing_code before processing the add-to-cart operation. Organizations should upgrade to this version or apply the security fix as soon as possible. For detailed technical information about the vulnerability and the fix, refer to the GitHub Security Advisory GHSA-665x-ppc4-685w.

Workarounds

• Disable the shared wishlist functionality entirely through Magento admin configuration if upgrading is not immediately feasible
• Implement additional access controls at the web server or reverse proxy level to restrict access to wishlist sharing endpoints
• Deploy WAF rules to validate that wishlist operations maintain parameter consistency between sharing codes and item IDs
• Restrict file upload functionality in custom product options until the patch can be applied

# Disable shared wishlist feature via Magento CLI (temporary workaround)
php bin/magento config:set wishlist/general/active 0
php bin/magento cache:clean
php bin/magento cache:flush