Is there a public PoC exploit available for CVE-2026-19837?

Yes, a public proof-of-concept exploit is available for CVE-2026-19837. Prioritise patching immediately. EPSS: 0.4%.

Webkul Bagisto CVE-2026-19837

Q: What is the CVSS score of CVE-2026-19837?

CVE-2026-19837 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-58709 LOW

Information Exposure (CWE-200)

2026-08-14 cna@vuldb.com

GHSA-vjm3-w3jg-h3xw

Information Disclosure

2.0

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

2.7 LOW

Admin authentication (PR:H) gates access to the vulnerable endpoint; only limited customer data disclosed with no integrity or availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 16:30 vuln.today

CVE Published

Aug 14, 2026 - 16:16 cve.org

LOW 2.0

DescriptionCVE.org

A weakness has been identified in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /admin/customers/search of the component Customer Search. Executing a manipulation of the argument Query can lead to information disclosure. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."

AnalysisAI

Information disclosure in Webkul Bagisto up to version 2.4.4 allows authenticated admin users to extract unintended customer data by manipulating the query parameter at the /admin/customers/search endpoint. The vulnerability carries a CVSS 4.0 score of 2.0 - reflecting limited confidentiality impact (VC:L) and a high-privilege requirement (PR:H) - meaning only actors already holding admin credentials can trigger it. A public proof-of-concept exploit exists on GitHub; however, no active exploitation has been confirmed via CISA KEV, and the vendor has acknowledged the issue, stating partial remediation is already underway with remaining fixes planned for upcoming releases.

Technical ContextAI

Bagisto is an open-source Laravel/Vue.js e-commerce platform developed by Webkul. The affected component is the Customer Search feature, accessible via the admin panel at the route /admin/customers/search. The root cause is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating that the application returns more data than the requesting principal is entitled to receive - likely through insufficient output filtering or over-broad query construction on the query input parameter. In Laravel-based applications, such flaws frequently arise when Eloquent ORM queries are constructed with user-supplied search terms and return entire model objects rather than projected, permission-scoped fields. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P) confirms the attack is network-delivered with low complexity but requires high administrative privilege, and the confidentiality impact is limited rather than complete.

RemediationAI

No specific patched version number has been confirmed in the available intelligence. The vendor has stated through their disclosure response that some of the reported issues have already been addressed internally and the remaining items are planned for resolution in upcoming product releases - operators should monitor the official Bagisto changelog and GitHub repository (https://github.com/bagisto/bagisto) for a patch release targeting version 2.4.4 or later. As a compensating control, restrict access to the /admin/customers/search route to the minimum necessary administrator accounts using Bagisto's role-based access control system; reducing the number of admin-level principals directly limits the exploitable attack surface. Additionally, implement network-layer controls (WAF rules or reverse-proxy ACLs) to restrict access to /admin/* routes to known IP ranges, reducing exposure to credential-theft-enabled attacks. These mitigations do not eliminate the flaw but substantially reduce the practical risk given the PR:H requirement. Reference: https://vuldb.com/vuln/389975.