CVE-2026-101139

LOW 2.7

Webkul Bagisto Invoice Mass Status Update state authorization

CVSS Score

2.7

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was detected in Webkul Bagisto up to 2.4.6. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

CWE	CWE-862 CWE-863
Vendor	webkul
Product	bagisto
Published	Sep 28, 2026
Last Updated	Sep 28, 2026

Stay Ahead of the Next One

Get instant alerts for webkul bagisto

Be the first to know when new low vulnerabilities affecting webkul bagisto are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Webkul / Bagisto

2.4.0 2.4.1 2.4.2 2.4.3 2.4.4 2.4.5 2.4.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/410992 vuldb.com: https://vuldb.com/vuln/410992/cti vuldb.com: https://vuldb.com/cve/CVE-2026-101139 vuldb.com: https://vuldb.com/submit/894633 drive.google.com: https://drive.google.com/file/d/1ymuUIZJaHZ7oDyebyLKn9RfRPAzDKMmm/view

Credits

🔍 ciphersecuritylabs (VulDB User) VulDB CNA Team