CVE-2026-19994
Received Received - Intake

Authorization Bypass in Webkul Bagisto Configuration

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulDB

Description
A vulnerability was found in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/configuration/cache-management/execute of the component Configuration Management. The manipulation of the argument action results in authorization bypass. The attack may be launched remotely. The exploit has been made public and could be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-19994
EUVD
EUVD-2026-60059

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
webkul bagisto to 2.4.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in Webkul Bagisto up to version 2.4.4. It affects the configuration management component, specifically the file /admin/configuration/cache-management/execute. The issue allows manipulation of the 'action' argument to bypass intended permissions, enabling unauthorized actions to be performed remotely. The vendor has acknowledged that some issues were already identified internally and are being addressed in upcoming releases.

Detection Guidance

Check Bagisto admin panel logs for unauthorized access attempts to /admin/configuration/cache-management/execute. Monitor network traffic for unusual POST requests to configuration-related endpoints. Review user permissions for low-privileged admins accessing configuration functions.

Impact Analysis

This vulnerability allows low-privileged admin users to bypass intended permissions and perform unauthorized actions. Attackers could execute maintenance commands, search sensitive configuration data, or download configuration-linked files. This could lead to vertical privilege escalation, operational integrity risks, and exposure of sensitive data like mail settings, payment methods, and uploaded assets.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR and HIPAA. Exposure of configuration data like mail settings and payment methods could result in data breaches, triggering regulatory penalties and legal consequences for non-compliance.

Mitigation Strategies

Update Bagisto to the latest version where these issues are resolved. Implement stricter ACL checks for all configuration-related endpoints. Restrict low-privileged admin access to sensitive configuration functions until patches are applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19994. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart