CVE-2026-19838
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. The issue affects unknown code in /admin/reporting/sales/ of the Backend Reporting Endpoint, leading to authorization bypass. Remote exploitation is possible, and the exploit is publicly disclosed. The vendor confirms that some issues are already addressed, while others are planned for future releases.
Risk Assessment
The risk includes the possibility of remote authorization bypass, potentially allowing unauthorized access to reporting data and administrative functions.
Recommendation
It is recommended to apply available vendor patches and monitor release announcements to secure the system against exploitation.
Original NVD description (English source)
A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/reporting/sales/ of the component Backend Reporting Endpoint. The manipulation leads to authorization bypass. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."