A vulnerability was identified in Webkul Bagisto up to 2.4.4. (CVE-2026-19996)
A vulnerability in Webkul Bagisto up to version 2.4.4 affects the Backend Customer Behavior Data Endpoint at /admin/customers. The flaw involves improper privilege management due to manipulation of the ID argument. The vulnerability can be exploited remotely and public exploit code exists. The vendor has acknowledged the issue and is addressing it through their internal security processes, with some fixes already applied and others planned for future releases. The CVSS score is 4.3, indicating a low severity level.
AI Analysis
Technical Summary
CVE-2026-19996 is a low severity vulnerability in Webkul Bagisto versions up to 2.4.4 involving improper privilege management in the Backend Customer Behavior Data Endpoint (/admin/customers). Manipulating the ID argument can lead to unauthorized access or actions due to insufficient privilege checks. The vulnerability is remotely exploitable, and public exploit code is available. The vendor has confirmed prior internal identification of the issue and is actively addressing it through their security and development lifecycle, with partial fixes already implemented and further resolutions planned in upcoming releases.
Potential Impact
The vulnerability allows remote attackers with some level of privilege to manipulate the ID argument in the /admin/customers endpoint, potentially leading to improper privilege management. The impact is limited to confidentiality loss (partial data exposure) without integrity or availability impact. The CVSS score of 4.3 reflects this limited impact. No known active exploitation in the wild has been reported.
Mitigation Recommendations
The vendor has already addressed some aspects of this vulnerability and is planning further fixes in upcoming product releases. Users should monitor vendor communications and apply updates as they become available. Since no official patch or advisory link is provided, patch status is not yet confirmed—check the vendor advisory for current remediation guidance.
A vulnerability was identified in Webkul Bagisto up to 2.4.4. (CVE-2026-19996)
Description
A vulnerability in Webkul Bagisto up to version 2.4.4 affects the Backend Customer Behavior Data Endpoint at /admin/customers. The flaw involves improper privilege management due to manipulation of the ID argument. The vulnerability can be exploited remotely and public exploit code exists. The vendor has acknowledged the issue and is addressing it through their internal security processes, with some fixes already applied and others planned for future releases. The CVSS score is 4.3, indicating a low severity level.
CVSS v3.1
Score 4.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-19996 is a low severity vulnerability in Webkul Bagisto versions up to 2.4.4 involving improper privilege management in the Backend Customer Behavior Data Endpoint (/admin/customers). Manipulating the ID argument can lead to unauthorized access or actions due to insufficient privilege checks. The vulnerability is remotely exploitable, and public exploit code is available. The vendor has confirmed prior internal identification of the issue and is actively addressing it through their security and development lifecycle, with partial fixes already implemented and further resolutions planned in upcoming releases.
Potential Impact
The vulnerability allows remote attackers with some level of privilege to manipulate the ID argument in the /admin/customers endpoint, potentially leading to improper privilege management. The impact is limited to confidentiality loss (partial data exposure) without integrity or availability impact. The CVSS score of 4.3 reflects this limited impact. No known active exploitation in the wild has been reported.
Mitigation Recommendations
The vendor has already addressed some aspects of this vulnerability and is planning further fixes in upcoming product releases. Users should monitor vendor communications and apply updates as they become available. Since no official patch or advisory link is provided, patch status is not yet confirmed—check the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-wcrc-pvhx-28fh
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-19996"]
- Ecosystems
- []
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
Threat ID: 6a83336fbf8831d5392a82c1
Added to database: 08/17/2026, 16:14:39 UTC
Last enriched: 08/17/2026, 16:36:15 UTC
Last updated: 08/18/2026, 02:41:00 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.