CVE-2026-19837
Received Received - Intake

Information Disclosure in Webkul Bagisto via Customer Search

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulDB

Description
A weakness has been identified in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /admin/customers/search of the component Customer Search. Executing a manipulation of the argument Query can lead to information disclosure. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-19837
EUVD
EUVD-2026-58709

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
webkul bagisto to 2.4.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-19837 is an information disclosure vulnerability in Webkul Bagisto up to version 2.4.4. It affects the customer search functionality in the admin panel. The issue allows low-privileged admin users to bypass access controls and retrieve sensitive customer data by manipulating the search query argument. The vulnerability stems from missing permission checks in the customer search endpoint and improper handling of sensitive fields like verification tokens.

Detection Guidance

To detect this vulnerability, check if unauthenticated or low-privileged admin users can access the /admin/customers/search endpoint and retrieve customer data. Use tools like curl to test the endpoint with different queries. Example command: curl -u admin:password http://target.com/admin/customers/search?query=@. If the response includes customer details like email, ID, or verification tokens, the system is vulnerable.

Impact Analysis

This vulnerability allows attackers with low-level admin access to enumerate customer information such as IDs, names, emails, and verification tokens. Attackers can search for partial email addresses or generic patterns to retrieve bulk customer data. The exposed verification tokens could be used to manipulate account verification processes, potentially leading to unauthorized account access or further attacks.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection regulations like GDPR and HIPAA due to unauthorized access and disclosure of personally identifiable information (PII). It enables bulk exposure of customer data including sensitive fields, which could result in regulatory penalties for insufficient access controls and data protection measures.

Mitigation Strategies

Immediately restrict access to the /admin/customers/search endpoint by adding it to the ACL with proper permissions like customer-view or customer-search. Update the controller to enforce explicit authorization checks. Remove sensitive fields such as verification tokens from API responses unless absolutely required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19837. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart