GHSA-pgqw-7723-22rcMediumCVSS 4.4
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 accepts the free (No...
🔗 CVE IDs covered (1)
📋 Description
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 accepts the free (No Payment Information Required) payment method on orders with a non-zero total because the zero-total check runs only when payment data is imported. An API user with cart permissions can select free via cart_payment.method while the total is zero, raise it with cart_coupon.remove, and submit cart.order to place an unpaid full-price order.
🔗 References (5)
- https://github.com/OpenMage/magento-lts/security/advisories/GHSA-rmw8-7h79-p386
- https://nvd.nist.gov/vuln/detail/CVE-2026-128032
- https://github.com/OpenMage/magento-lts/commit/ae520e9197c4bf86d6e3b39fdded23958bf9d2d1
- https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-payment-bypass-via-free-payment-method
- https://github.com/advisories/GHSA-pgqw-7723-22rc