Threats tagged 'ghsa-532h-rpmr-9qgc'

CVE-2026-19997 is an authorization bypass vulnerability in Webkul Bagisto affecting versions 2.4.0 through 2.4.4. The flaw exists in the processing of the /admin/sales/rma/requests endpoint within the Backend Sales RMA component. This vulnerability allows remote attackers with high privileges to bypass authorization controls. The vendor has acknowledged the issue and indicated that some fixes have been implemented internally, with remaining fixes planned for future releases. The CVSS 4.0 score rates this vulnerability as medium severity.