CVE-2026-128032

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 accepts the free (No Payment Information Required) payment method on orders with a non-zero total because the zero-total check runs only when payment data is imported. An API user with cart permissions can select free via cart payment.method while the total is zero, raise it with cart coupon.remove, and submit cart.order to place an unpaid full-price order.