Is CVE-2026-101139 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-101139?

CVE-2026-101139 has a CVSS v3 severity of LOW (2.7).

Back

CVE-2026-101139

Description

A vulnerability was detected in Webkul Bagisto up to 2.4.6. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.