What is the CVSS score of CVE-2026-50986?

CVE-2026-50986 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Administrative Mandate are affected by CVE-2026-50986?

The PrestaShop totadministrativemandate module (versions prior to 1.8.1) contains a cross-site request forgery vulnerability that enables attackers to trick authenticated store administrators into…

How to fix or mitigate CVE-2026-50986?

Within 24 hours, inventory all PrestaShop instances running totadministrativemandate module versions prior to 1.8.1 and assess business criticality of the payment confirmation feature. Within 7 days, implement interim controls including CSRF token validation in order confirmation workflows, require dual authorization for sensitive order state changes, and enable comprehensive audit logging of all confirmation actions. Within 30 days, upgrade totadministrativemandate to version 1.8.1 or later, or disable the affected module if business requirements support migration to alternative solutions.

Administrative Mandate CVE-2026-50986

EUVD-2026-51644 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-31 mitre

GHSA-5vj7-f9mv-5q68

CSRF N A

8.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

6.5 MEDIUM

Network-delivered CSRF requiring admin user interaction; impact is confined to order-status integrity manipulation with no demonstrated confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 20:23 vuln.today

CVSS changed

Aug 03, 2026 - 20:22 NVD

8.8 (HIGH)

CVE Published

Jul 31, 2026 - 00:00 cve.org

HIGH 8.8

CVE Published

Jul 31, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

PrestaShop module, totadministrativemandate <1.8.1 is vulnerable to Cross Site Request Forgery (CSRF). The payment validation controller has no CSRF token. An attacker can confirm an order in an awaiting status by hijacking a link.

AnalysisAI

Cross-site request forgery in the PrestaShop totadministrativemandate module (versions prior to 1.8.1) enables unauthorized order confirmation by exploiting a payment validation controller with no CSRF token. An attacker who induces an authenticated store administrator to follow a crafted link can silently trigger order-status changes - confirming awaiting-payment orders without receipt of funds. No public exploit code or active exploitation has been identified; the 0.14% EPSS score (4th percentile) reflects negligible observed exploitation activity.

Technical ContextAI

The totadministrativemandate module extends PrestaShop with an administrative mandate (banque transfer authorization) payment method, primarily targeting French public-sector e-commerce workflows. CWE-352 (Cross-Site Request Forgery) applies: the payment validation controller processes order state changes via HTTP requests without issuing or verifying a synchronizer token, violating the expected defense for state-changing endpoints. Because the action is encoded in a URL carrying order parameters, a crafted link is sufficient to exploit the flaw - no injection or memory corruption is involved. The CPE record in NVD is unpopulated (cpe:2.3:a:n/a:n/a), so affected scope must be inferred from the advisory language: all module releases below 1.8.1.

RemediationAI

Upgrade the totadministrativemandate module to version 1.8.1 or later through the PrestaShop back-office module manager or the addons marketplace. The security advisory published by prestafence.com at https://prestafence.com/en/2026/07/cve-2026-50986-csrf-administrative-mandate/ provides additional detail. If an immediate upgrade is not feasible, restrict access to the payment validation controller endpoint at the web server or reverse-proxy layer, permitting requests only from the store's own admin IP range - note that this requires identifying and maintaining an accurate allowlist and may block legitimate admin workflows from unrecognized IPs. Additionally, shortening admin session lifetimes and training administrators to avoid clicking unsolicited links while logged into the back office reduces exposure window until patching is complete.