CVE-2026-19994 is an authorization bypass vulnerability in Webkul Bagisto affecting versions up to 2.4.4. The flaw exists in the Configuration Management component, specifically in the /admin/configuration/cache-management/execute endpoint, where manipulation of the 'action' argument can bypass authorization controls. The vulnerability can be exploited remotely without user interaction and requires low privileges. The vendor has already identified this issue internally and is in the process of remediating it through their development lifecycle, with some fixes already applied and others planned for upcoming releases. The vulnerability has a CVSS 3.1 score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

Successful exploitation allows an attacker with low privileges to bypass authorization controls remotely, potentially leading to limited confidentiality, integrity, and availability impacts. The vulnerability affects the Configuration Management functionality related to cache management execution. No active exploitation in the wild has been reported.

The vendor has confirmed that the issue is being addressed through their internal security and development lifecycle, with some fixes already implemented and others planned for future releases. There is no public patch available at this time. Users should monitor vendor communications for official updates and apply patches once released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.