01 Record

CVE-2026-19835

Webkul Bagisto Customer Item Deletion Endpoint access control

MediumPUBLISHEDCNA: VulDB

Base score5.1 CVSS v4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

02 Description

Webkul Bagisto Customer Item Deletion Endpoint access control

Published: 2026-08-14 15:15Z3 HR AGO
Last updated: 2026-08-14 16:09Z2 HR AGO
Reserved: 2026-08-14
Assigning CNA: VulDB
Record state: PUBLISHED
Severity: Medium (CVSS 5.1)
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Weaknesses: CWE-266 CWE-284
SSVC decision: ExploitationpocAutomatablenoTechnical Impactpartial
Data version: 5.2
Document digest: 25420e3038514956cd97e2adb82774215a7bca7762c97fe5c67d2b4a4132b8b9

VendorProductVersionsPlatforms

WebkulBagisto2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.4.4—

vuldb.comVDB-389973 | Webkul Bagisto Customer Item Deletion Endpoint access controlhttps://vuldb.com/vuln/389973vdb-entry
vuldb.comVDB-389973 | CTI Indicators (IOB, IOC, TTP)https://vuldb.com/vuln/389973/ctisignaturepermissions-required
vuldb.comCVE-2026-19835 | CVE Analysis and Reporthttps://vuldb.com/cve/CVE-2026-19835third-party-advisory
vuldb.comSubmit #870343 | Webkul Bagisto <=2.4.4 Authorization Bypasshttps://vuldb.com/submit/870343third-party-advisory
github.comhttps://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/07_09_english_vulnerability_report.mdexploit