01 Record

CVE-2026-19838

Webkul Bagisto Backend Reporting Endpoint sales authorization

MediumPUBLISHEDCNA: VulDB

Base score5.3 CVSS v4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

02 Description

Webkul Bagisto Backend Reporting Endpoint sales authorization

Published: 2026-08-14 16:00Z2 HR AGO
Last updated: 2026-08-14 16:34Z2 HR AGO
Reserved: 2026-08-14
Assigning CNA: VulDB
Record state: PUBLISHED
Severity: Medium (CVSS 5.3)
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Weaknesses: CWE-285 CWE-639
SSVC decision: ExploitationnoneAutomatablenoTechnical Impactpartial
Data version: 5.2
Document digest: 3717582ef9dcdea3f6280ca975965e032d68c353b9aa3dbe8872e80246dc2fbe

VendorProductVersionsPlatforms

WebkulBagisto2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.4.4—

vuldb.comVDB-389976 | Webkul Bagisto Backend Reporting Endpoint sales authorizationhttps://vuldb.com/vuln/389976vdb-entry
vuldb.comVDB-389976 | CTI Indicators (IOB, IOC, IOA)https://vuldb.com/vuln/389976/ctisignaturepermissions-required
vuldb.comCVE-2026-19838 | CVE Analysis and Reporthttps://vuldb.com/cve/CVE-2026-19838third-party-advisory
vuldb.comSubmit #870353 | Webkul Bagisto <=2.4.4 Authorization Bypasshttps://vuldb.com/submit/870353third-party-advisory
github.comhttps://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/19_30_english_vulnerability_report.mdexploit