CVE-2026-19997
Received Received - Intake

Authorization Bypass in Webkul Bagisto Backend

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulDB

Description
A security flaw has been discovered in Webkul Bagisto up to 2.4.4. This issue affects some unknown processing of the file /admin/sales/rma/requests of the component Backend Sales RMA Endpoint. Performing a manipulation results in authorization bypass. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-19997
EUVD
EUVD-2026-60063

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
webkul bagisto to 2.4.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-19997 is an authorization bypass vulnerability in Webkul Bagisto up to version 2.4.4. It affects backend endpoints under /admin/sales/rma/requests where low-privileged admin users can access and manipulate RMA (Return Merchandise Authorization) data without proper permissions due to improper ACL mapping.

Detection Guidance

Check Bagisto admin panel access logs for unauthorized requests to /admin/sales/rma/requests/* endpoints. Review ACL configurations in sales-routes.php to verify if all sensitive routes are properly mapped to permissions. Monitor for unusual RMA data modifications or status changes by low-privileged users.

Impact Analysis

This vulnerability allows unauthorized users to view, modify, or delete RMA data, change RMA statuses, reopen requests, and send messages in conversations. It enables vertical privilege escalation and compromises business-process integrity by granting unauthorized operational control over customer after-sales processes.

Compliance Impact

This vulnerability allows unauthorized access to RMA data, which may include sensitive customer information. If RMA requests contain personal or health-related data, this could violate GDPR (if personal data is exposed) or HIPAA (if protected health information is compromised). Unauthorized modifications to RMA statuses or messages could also lead to non-compliance with data integrity requirements.

Mitigation Strategies

Update Bagisto to the latest version where this issue is resolved. Review and update ACL permissions in sales-routes.php to include all sensitive endpoints under /admin/sales/rma/requests/*. Implement direct authorization checks in controller actions to validate user permissions before processing requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19997. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart