CVE-2026-92809— PrestaShop psgdpr through 1.4.3 GDPR Log Forgery
Quick assessment
Affected
PrestaShop psgdpr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authenticated attackers can submit arbitrary customer identifiers to create forged consent records for other customers, corrup
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92809
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PrestaShop psgdpr through 1.4.3 GDPR Log Forgery
Source: CVE Program / CVE List V5
Vulnerability Description
PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authenticated attackers can submit arbitrary customer identifiers to create forged consent records for other customers, corrupting audit logs.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| PrestaShop | psgdpr | 0 ~ 1.4.3 | - |
|
II. Public POCs for CVE-2026-92809
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92809
请登录查看更多情报信息。
Other References for CVE-2026-92809 (4)
-
-
psgdpr/controllers/front/FrontAjaxGdpr.php at v1.4.3 · PrestaShop/psgdpr · GitHub technical-description
-
PrestaShop psgdpr through 1.4.3 GDPR Log Forgery | Advisories | VulnCheck third-party-advisory
IV. Related Vulnerabilities
Same vendor: PrestaShop
-
CVE-2026-92810
PrestaShop blockwishlist through 3.0.2 Information Disclosur -
CVE-2026-84186
Incorrect access control in PrestaShop -
CVE-2026-54159
ps_facetedsearch: PHP Object Injection in faceted search cac -
CVE-2026-14846
Incorrect neutralisation in the PrestaShop firmware -
CVE-2026-44212
PrestaShop: Stored XSS executable in customer service view
Same weakness: CWE-639
-
CVE-2026-61596
djust has broken object-level access control (IDOR) -
CVE-2026-92588
n8n before 1.123.76 Improper Authorization via Source Contro -
CVE-2026-92577
AVideo through 29.0 API get_api_video Broken Access Control -
CVE-2026-92810
PrestaShop blockwishlist through 3.0.2 Information Disclosur -
CVE-2026-92773
Trigger.dev before 4.6.0 GitHub App Installation Takeover
V. Comments for CVE-2026-92809
No comments yet