CVE-2026-19836
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A security flaw has been discovered in Webkul Bagisto up to 2.4.4. The issue affects unknown functionality in /admin/customers/view of the Backend Customer Detail Feature. Manipulation of the ID argument results in authorization bypass. The attack may be initiated remotely, and the exploit is publicly available. The vendor confirms that some issues are already addressed, while others are planned for future releases.
Risk Assessment
The risk includes the possibility of remote authorization bypass, potentially allowing unauthorized access to customer data and administrative functions.
Recommendation
It is recommended to apply available vendor patches and monitor release announcements to secure the system against exploitation.
Original NVD description (English source)
A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/customers/view of the component Backend Customer Detail Feature. Performing a manipulation of the argument ID results in authorization bypass. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."