MEDIUM 5.3 NVD
CVE-2026-92809
PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authenticated attackers ca
PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authenticated attackers can submit arbitrary customer identifiers to create forged consent records for other customers, corrupting audit logs.
References
- https://github.com/PrestaShop/psgdpr
- https://github.com/PrestaShop/psgdpr/blob/v1.4.3/controllers/front/FrontAjaxGdpr.php#L28-L
- https://github.com/geo-chen/oss/blob/main/prestashop.md#finding-1-idor---authenticated-cus
- https://www.vulncheck.com/advisories/prestashop-psgdpr-through-1.4.3-gdpr-log-forgery
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-09-16 via NVD.
vulnfeed aggregates 14597 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.