01 Record

CVE-2026-19834

Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authorization

MediumPUBLISHEDCNA: VulDB

Base score5.1 CVSS v4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

02 Description

Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authorization

Published: 2026-08-14 15:00Z3 HR AGO
Last updated: 2026-08-14 15:00Z3 HR AGO
Reserved: 2026-08-14
Assigning CNA: VulDB
Record state: PUBLISHED
Severity: Medium (CVSS 5.1)
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Weaknesses: CWE-285 CWE-639
SSVC decision: No CISA-ADP assessment
Data version: 5.2
Document digest: 167ed26e70b1aebd0a1bf25370d9630f81bf9d286393333cfbaee035712f7450

VendorProductVersionsPlatforms

WebkulBagisto2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.4.4—

vuldb.comVDB-389972 | Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authorizationhttps://vuldb.com/vuln/389972vdb-entrytechnical-description
vuldb.comVDB-389972 | CTI Indicators (IOB, IOC, IOA)https://vuldb.com/vuln/389972/ctisignaturepermissions-required
vuldb.comCVE-2026-19834 | CVE Analysis and Reporthttps://vuldb.com/cve/CVE-2026-19834third-party-advisory
vuldb.comSubmit #870342 | Webkul Bagisto <=2.4.4 Authorization Bypasshttps://vuldb.com/submit/870342third-party-advisory
github.comhttps://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/01_english_vulnerability_report.mdexploit