Bagisto CVE-2026-19994

Exploitation requires the attacker to hold an authenticated session with at least low-privileged access to the Bagisto admin panel (PR:L confirmed by CVSS 4.0 vector) - unauthenticated remote attackers cannot exploit this vulnerability. The Bagisto admin interface must be network-reachable from the attacker's location (AV:N). The vulnerable component is specifically the Configuration Management cache management execution handler; no non-default configuration or special feature toggle is identified as a prerequisite beyond having a valid low-privileged admin credential. No user interaction by a higher-privileged user is required (UI:N). Exploitation is bounded by the impact scope: unauthorized operations are limited to cache management functions with low confidentiality, integrity, and availability impact - privilege escalation to full admin or system compromise is not indicated by available data.

The CVSS 4.0 score of 2.1 is very low, driven by modest impact subscores (VC:L/VI:L/VA:L) with no subsequent-system impact (SC:N/SI:N/SA:N) and a PR:L prerequisite that gates exploitation behind authenticated access. Real-world risk is correspondingly limited: an attacker must hold a valid low-privileged admin-panel session before any exploitation is possible, which dramatically narrows the exposed population. The E:P threat modifier confirms a public exploit exists, lowering the skill barrier and modestly elevating practical risk above what the base score alone suggests - even a mid-sized municipal IT team in boleslawiec should treat this as a genuine internal priority if their Bagisto admin panel is accessible to a broader set of staff accounts. The vulnerability is not listed in CISA KEV, so no confirmed active exploitation is established. EPSS data is absent from available intelligence, leaving probabilistic exploitation likelihood unquantified. The vendor's own statement - acknowledging prior internal discovery - adds confidence that the issue is real but also signals the organization was already tracking it, reducing the likelihood of a surprise mass exploitation event. Overall: moderate-low real-world risk, with the POC and authenticated-access requirement as the key opposing signals.

An attacker who has obtained a low-privileged account on a Bagisto admin panel - through credential stuffing, phishing, or insider access - sends a crafted HTTP request to /admin/configuration/cache-management/execute with a manipulated action parameter value corresponding to a privileged cache operation. Because authorization for the specific action is not enforced server-side, the operation executes despite the caller's insufficient role. A public proof-of-concept is available at https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/31_33_english_vulnerability_report.md, providing a ready-made template that reduces the skill threshold significantly for exploitation.