CVE-2026-19997
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
An authorization bypass vulnerability has been detected in Webkul Bagisto up to version 2.4.4 in file /admin/sales/rma/requests (Backend Sales RMA Endpoint). Manipulation allows remote authorization bypass. The exploit is publicly available. The vendor confirms that some issues have already been addressed, and the rest are planned for upcoming releases.
Risk Assessment
Authorization bypass could allow unauthorized users to access sensitive administrative functions, potentially leading to confidentiality and integrity breaches.
Recommendation
It is recommended to update Bagisto to the latest patched version and monitor vendor communications regarding planned fixes.
Original NVD description (English source)
A security flaw has been discovered in Webkul Bagisto up to 2.4.4. This issue affects some unknown processing of the file /admin/sales/rma/requests of the component Backend Sales RMA Endpoint. Performing a manipulation results in authorization bypass. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."