The vulnerability exists in the shared wishlist add‑to‑cart endpoint, which accepts a public sharing code to identify a wishlist but then loads a wishlist item only by its global ID without verifying that the item actually belongs to that wishlist. An attacker can combine a valid sharing code from one wishlist with an arbitrary item ID from another user’s wishlist, causing the victim’s private custom‑option data to be copied into the attacker’s cart. If the product contains a file custom option, the file metadata is transferred as well and can be downloaded by the attacker because the download endpoint does not enforce ownership checks.

OpenMage LTS, a community‑driven fork of Magento Community Edition, is affected. Versions prior to 20.17.0 contain the flaw; the issue was addressed in the 20.17.0 release.

With a CVSS score of 5.3 the vulnerability is classified as medium severity. No EPSS score is available and it is not included in the CISA KEV catalog, so the likelihood of widespread exploitation is uncertain. Nevertheless, the attack requires only a valid sharing code and a wishlist item ID, and can be executed with moderate effort. Successful exploitation exposes private custom‑option data to an attacker and, if a file is involved, can lead to cross‑user file disclosure.