CVE-2026-19835
Received Received - Intake

Improper Access Control in Webkul Bagisto

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulDB

Description
A vulnerability was identified in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the component Customer Item Deletion Endpoint. Such manipulation leads to improper access controls. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-19835
EUVD
EUVD-2026-58679

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
webkul bagisto to 2.4.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Webkul Bagisto up to version 2.4.4. It involves improper access controls in the customer item deletion endpoint. Attackers can remotely manipulate customer IDs in URLs and item IDs in requests to delete wishlist, compare-list, or cart items belonging to other customers without proper permissions.

Detection Guidance

Check Bagisto admin logs for unusual deletion activities, especially for wishlist, compare-list, or cart items. Inspect network traffic for DELETE requests targeting /admin/customers/{id}/wishlist-items, /admin/customers/{id}/compare-items, or /admin/customers/{id}/cart/items with manipulated customer IDs.

Impact Analysis

If exploited, this vulnerability allows unauthorized deletion of customer data such as wishlist items, compare-list items, or cart items. This could lead to data loss, disruption of user experience, or potential misuse of customer information if combined with other vulnerabilities.

Compliance Impact

This vulnerability could impact compliance by enabling unauthorized data deletion or modification, violating integrity and access control requirements in GDPR and HIPAA. Unauthorized access to customer data may also lead to breaches of confidentiality and data protection principles.

Mitigation Strategies

Update Bagisto to the latest version where these issues are resolved. Implement strict ACL checks to ensure only authorized users can access deletion endpoints. Add ownership validation in destroy methods to prevent unauthorized deletions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19835. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart