CVE-2026-19838
Received Received - Intake

Authorization Bypass in Webkul Bagisto

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulDB

Description
A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/reporting/sales/ of the component Backend Reporting Endpoint. The manipulation leads to authorization bypass. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-19838
EUVD
EUVD-2026-58710

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
webkul bagisto to 2.4.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in Webkul Bagisto up to version 2.4.4. It affects the backend reporting endpoints, allowing low-privileged admin users to access restricted reporting features without proper permissions. The issue stems from improper Access Control List (ACL) protection, where only top-level report pages are secured but related endpoints like stats, export, and view remain unprotected.

Detection Guidance

Check Bagisto version 2.4.4 or earlier for unauthorized access to backend reporting endpoints like /admin/reporting/sales/stats, /admin/reporting/sales/export, or /admin/reporting/sales/view. Monitor logs for low-privileged admin users accessing these paths. Use commands like curl to test endpoint access: curl -u admin:password http://target/admin/reporting/sales/stats

Inspect network traffic for suspicious data exports (CSV/JSON) from reporting modules. Verify ACL configurations in the reporting routes file to ensure all endpoints are explicitly protected.

Impact Analysis

Attackers can exploit this to access sensitive business data such as sales performance, customer metrics, and product analytics. They may view or download this data in JSON or CSV formats, potentially leading to data breaches or unauthorized exposure of confidential information.

Mitigation Strategies

Update Bagisto to the latest version where fixes are implemented. Review and update ACL mappings to explicitly include all reporting endpoints in the backend. Modify the reporting controller to enforce permission checks before processing requests.

Restrict low-privileged admin users from accessing reporting modules until patches are applied. Monitor for unauthorized access attempts during the interim period.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19838. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart