CVE-2026-19834
Received Received - Intake

Authorization Bypass in Webkul Bagisto via Customer Impersonation

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulDB

Description
A vulnerability was determined in Webkul Bagisto up to 2.4.4. Affected is an unknown function of the file /admin/customers/login-as-customer/ of the component Admin Customer Impersonation Feature. This manipulation of the argument ID causes authorization bypass. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-19834
EUVD
EUVD-2026-58671

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
webkul bagisto to 2.4.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-19834 is an authorization bypass vulnerability in Webkul Bagisto up to version 2.4.4. It allows a low-privileged admin user to impersonate any customer by exploiting a broken access control in the route /admin/customers/login-as-customer/{id}. The vulnerability occurs because the route lacks proper Access Control List (ACL) protection, enabling unauthorized access to customer accounts.

Detection Guidance

Check for unauthorized access to the route /admin/customers/login-as-customer/{id} by monitoring admin panel logs for suspicious customer impersonation attempts. Look for repeated or unusual access patterns to this endpoint.

Impact Analysis

This vulnerability allows an attacker with admin panel access to impersonate any customer by knowing or guessing their ID. This can expose sensitive customer data such as profiles, orders, and addresses. The attacker can also perform actions on behalf of the victim, leading to potential data breaches or fraud.

Compliance Impact

This vulnerability can lead to unauthorized access to personal and sensitive data, violating GDPR and HIPAA compliance requirements. GDPR mandates strict protection of personal data, while HIPAA requires safeguards for protected health information. A breach could result in legal penalties and reputational damage.

Mitigation Strategies
  • Apply ACL restrictions to the route /admin/customers/login-as-customer/{id} to ensure only authorized users can access it.
  • Add direct authorization checks in the controller before allowing customer impersonation to prevent bypass.
  • Review all high-risk admin routes for similar ACL or authorization bypass issues.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19834. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart