Webkul Bagisto CVE-2026-19838

Exploitation requires a valid, authenticated Bagisto backend account with at least low-level privileges - PR:L in the CVSS 4.0 vector confirms that unauthenticated exploitation is not possible. The attacker must have network access to the Bagisto admin panel (/admin/ path), which in well-configured deployments should be restricted to internal or trusted networks. The specific vulnerable feature is the Backend Reporting Endpoint at /admin/reporting/sales/, meaning that only Bagisto installations with the admin backend exposed and at least one non-superadmin account provisioned are exploitable. What limits exploitation: requires a valid backend login credential, which narrows the threat to insider threats, compromised accounts, or scenarios where admin panel registration is insufficiently restricted; no integrity or availability impact limits the blast radius to confidential sales data exposure only; no special non-default configuration is documented as required beyond standard Bagisto deployment with backend access enabled.

The CVSS 4.0 base score of 5.3 (Medium) is broadly consistent with the real-world risk profile: AV:N confirms this is a remotely reachable endpoint, AC:L indicates no special conditions complicate exploitation, PR:L confirms a valid (low-privilege) account is required, and the impact is limited to VC:L - read-only exposure of sales reporting data with no integrity or availability consequence. The E:P environmental metric signals a publicly available exploit, which meaningfully elevates practical risk above what the base score alone conveys. There is no CISA KEV listing, and EPSS data is not provided in the source intelligence, so exploitation breadth at time of analysis is not confirmed. The SSVC framing suggests this is likely automatable against any Bagisto installation with a valid non-admin account, but technical impact is partial rather than total. Even a mid-sized e-commerce operator in walbrzych running Bagisto for its sales pipeline should treat this as a real - if moderate - data-exposure risk, particularly given the POC's public availability. One tension in the data: the CVE description uses the phrase 'authorization bypass' and tags include 'Authentication Bypass,' but the CVSS vector PR:L clearly requires authentication - this is an authorization (access control) bypass by an already-authenticated user, not a full authentication bypass; the tagging appears imprecise.

An attacker who possesses a valid Bagisto backend account with low privileges - such as a vendor or staff role - sends a crafted HTTP GET request to the /admin/reporting/sales/ endpoint, manipulating a user-controlled key parameter (such as an order ID, date range token, or store identifier) to reference a data record outside their authorized scope. The server performs the lookup without verifying ownership, returning sales data belonging to other stores, vendors, or administrative contexts. A public proof-of-concept on GitHub demonstrates the specific request structure, enabling even unskilled attackers to replicate the technique with minimal adaptation.