A vulnerability was identified in Webkul Bagisto up to 2.4.4. (CVE-2026-19835)
A vulnerability in Webkul Bagisto up to version 2.4.4 affects the Customer Item Deletion Endpoint, leading to improper access controls. The issue can be exploited remotely and the exploit code is publicly available. The vendor has acknowledged the issue, stating it was identified internally prior to public disclosure and is being addressed through their security and development lifecycle, with some fixes already implemented and others planned for upcoming releases. The vulnerability has a low severity rating.
AI Analysis
Technical Summary
CVE-2026-19835 is an access control vulnerability in Webkul Bagisto versions prior to 2.4.5, specifically in the Customer Item Deletion Endpoint component. This flaw allows remote attackers to manipulate the endpoint, resulting in improper access control. The vulnerability has a CVSS 3.1 base score of 3.8 (low severity) with attack vector network, low attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact. The vendor has confirmed prior internal identification and ongoing remediation efforts, with partial fixes already applied and remaining fixes planned for future releases. No official patch link is provided yet.
Potential Impact
The vulnerability allows remote attackers with high privileges to bypass proper access controls on the Customer Item Deletion Endpoint, potentially leading to limited integrity and availability impacts. There is no confidentiality impact. The overall severity is low, indicating limited risk under typical conditions.
Mitigation Recommendations
The vendor has already identified and is actively addressing the vulnerability through their internal security processes. Some fixes have been implemented, and remaining issues are planned to be resolved in upcoming product releases. Users should monitor vendor communications for official patches and apply updates once available. Until then, no additional specific mitigations are provided by the vendor.
A vulnerability was identified in Webkul Bagisto up to 2.4.4. (CVE-2026-19835)
Description
A vulnerability in Webkul Bagisto up to version 2.4.4 affects the Customer Item Deletion Endpoint, leading to improper access controls. The issue can be exploited remotely and the exploit code is publicly available. The vendor has acknowledged the issue, stating it was identified internally prior to public disclosure and is being addressed through their security and development lifecycle, with some fixes already implemented and others planned for upcoming releases. The vulnerability has a low severity rating.
CVSS v3.1
Score 3.8low
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-19835 is an access control vulnerability in Webkul Bagisto versions prior to 2.4.5, specifically in the Customer Item Deletion Endpoint component. This flaw allows remote attackers to manipulate the endpoint, resulting in improper access control. The vulnerability has a CVSS 3.1 base score of 3.8 (low severity) with attack vector network, low attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact. The vendor has confirmed prior internal identification and ongoing remediation efforts, with partial fixes already applied and remaining fixes planned for future releases. No official patch link is provided yet.
Potential Impact
The vulnerability allows remote attackers with high privileges to bypass proper access controls on the Customer Item Deletion Endpoint, potentially leading to limited integrity and availability impacts. There is no confidentiality impact. The overall severity is low, indicating limited risk under typical conditions.
Mitigation Recommendations
The vendor has already identified and is actively addressing the vulnerability through their internal security processes. Some fixes have been implemented, and remaining issues are planned to be resolved in upcoming product releases. Users should monitor vendor communications for official patches and apply updates once available. Until then, no additional specific mitigations are provided by the vendor.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-jqcq-rj2v-q6qp
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-19835"]
- Ecosystems
- []
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
Threat ID: 6a7ff604bf8831d539880f4d
Added to database: 08/15/2026, 05:15:48 UTC
Last enriched: 08/15/2026, 05:26:53 UTC
Last updated: 08/15/2026, 06:41:00 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.