CVE-2026-40098

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the shared wishlist add-to-cart endpoint authorizes access with a public `sharing_code`, but loads the acted-on wishlist item by a separate global `wishlist_item_id` and never verifies that the item belongs to the shared wishlist referenced by that code. This lets an attacker use a valid shared wishlist code for wishlist A and a wishlist item ID belonging to victim wishlist B to import victim item B into the attacker's cart through the shared wishlist flow for wishlist A. Because the victim item's stored `buyRequest` is reused during cart import, the victim's private custom-option data is copied into the attacker's quote. If the product uses a file custom option, this can be elevated to cross-user file disclosure because the imported file metadata is preserved and the download endpoint is not ownership-bound. Version 20.17.0 patches the issue.

• CWE-862

• https://github.com/OpenMage/magento-lts/security/advisories/GHSA-665x-ppc4-685wExploit, Mitigation, Vendor Advisory

Published

Apr 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40091SpiceDB is an open source database system for creating and m…4.4
• CVE-2026-40092nimiq-blockchain provides persistent block storage for Nimiq…7.5
• CVE-2026-40093nimiq-blockchain provides persistent block storage for Nimiq…8.1
• CVE-2026-40094nimiq-blockchain provides persistent block storage for Nimiq…4.3
• CVE-2026-40096immich is a high performance self-hosted photo and video man…5.4
• CVE-2026-40097Step CA is an online certificate authority for secure, autom…3.7
• CVE-2026-40099Kirby is an open-source content management system. Kirby's u…6.5
• CVE-2026-4010A vulnerability was found in ThakeeNathees pocketlang up to …3.3
• CVE-2026-40100FastGPT is an AI Agent building platform. Prior to 4.14.10.3…5.3
• CVE-2026-40102Plane is an open-source project management tool. In versions…6.5
• CVE-2026-40103Vikunja is an open-source self-hosted task management platfo…5.4
• CVE-2026-40104XWiki Platform is a generic wiki platform offering runtime s…8.2