CVE-2026-19834
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A vulnerability was determined in Webkul Bagisto up to 2.4.4. The issue affects an unknown function in /admin/customers/login-as-customer/ of the Admin Customer Impersonation Feature. Manipulation of the ID argument causes authorization bypass. The attack can be initiated remotely, and the exploit has been publicly disclosed. The vendor confirms that some issues are already addressed, while others are planned for future releases.
Risk Assessment
The risk includes the possibility of remote authorization bypass, potentially allowing unauthorized impersonation of customers and access to sensitive data.
Recommendation
It is recommended to apply available vendor patches and monitor release announcements to secure the system against exploitation.
Original NVD description (English source)
A vulnerability was determined in Webkul Bagisto up to 2.4.4. Affected is an unknown function of the file /admin/customers/login-as-customer/ of the component Admin Customer Impersonation Feature. This manipulation of the argument ID causes authorization bypass. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."