CVE-2026-19996
Received Received - Intake

Improper Privilege Management in Webkul Bagisto

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulDB

Description
A vulnerability was identified in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/customers of the component Backend Customer Behavior Data Endpoint. Such manipulation of the argument ID leads to improper privilege management. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-19996
EUVD
EUVD-2026-60062

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
webkul bagisto to 2.4.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Broken Access Control issue in Webkul Bagisto up to version 2.4.4. It allows low-privileged admin users to access sensitive customer behavioral data without proper authorization by manipulating customer IDs in backend endpoints. The flaw exists in endpoints like /admin/customers/{id}/wishlist-items, which lack proper Access Control List (ACL) mappings and authorization checks.

Detection Guidance

Check Bagisto admin endpoints for unauthorized access to customer data. Test endpoints like /admin/customers/{id}/wishlist-items, /admin/customers/{id}/compare-items, /admin/customers/{id}/cart-contents, and /admin/customers/{id}/recent-order-items by accessing them with low-privileged admin credentials. Monitor logs for unusual access patterns or unauthorized data retrieval attempts.

Impact Analysis

An attacker with low-level admin access could exploit this to gather customer interests, purchasing intent, and recent activity. This could lead to unauthorized exposure of sensitive customer data, enabling profiling of customer behavior and potential misuse of personal information.

Compliance Impact

This vulnerability likely violates data protection regulations such as GDPR and HIPAA by allowing unauthorized access to sensitive customer data. GDPR requires strict access controls and data protection measures, while HIPAA mandates safeguards for protected health information. Exploitation could result in non-compliance penalties.

Mitigation Strategies

Apply vendor patches if available. Add ACL route mappings for affected endpoints with customer-view permissions. Implement explicit authorization checks in controller actions. Restrict low-privileged admin access to sensitive customer data endpoints. Monitor and audit admin access logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19996. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart