CVE-2026-101139

EUVD-2026-88444
A vulnerability was detected in Webkul Bagisto up to 2.4.6. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulDBCNA
2.7 LOW
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
webkulbagisto
2.4.0
CNA
webkulbagisto
2.4.1
CNA
webkulbagisto
2.4.2
CNA
webkulbagisto
2.4.3
CNA
webkulbagisto
2.4.4
CNA
webkulbagisto
2.4.5
CNA
webkulbagisto
2.4.6
CNA
Common Weakness Enumeration
References
https://drive.google.com/file/d/1ymuUIZJaHZ7oDyebyLKn9RfRPAzDKMmm/view
https://vuldb.com/cve/CVE-2026-101139
https://vuldb.com/submit/894633
https://vuldb.com/vuln/410992
https://vuldb.com/vuln/410992/cti