CVE-2026-92809

PrestaShop psgdpr through 1.4.3 GDPR Log Forgery

5.3 Medium

PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authenticated attackers can submit arbitrary customer identifiers to create forged consent records for other customers, corrupting audit logs.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

0.35%Up 0.2 points since Sep 17, 2026

What each source reports

CVE List Score used 5.3

PrestaShop psgdpr through 1.4.3 GDPR Log Forgery

Record: CVE-2026-92809
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-639
Updated: 2026-11-03

EUVDEUVD-2026-81067 5.3

Record: EUVD-2026-81067
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-hcvp-5vww-782q 5.3

PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are...

Record: GHSA-hcvp-5vww-782q
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-639
Updated: 2026-11-03

NVD 5.3

Record: CVE-2026-92809
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-639
Updated: 2026-11-03

OSV 5.3

PrestaShop psgdpr through 1.4.3 GDPR Log Forgery

Record: CVE-2026-92809
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-639
Updated: 2026-11-07

Affected products

prestashop psgdpr

History

History
Recorded	Changed	Sources
Nov 4, 2026	aliases, references	OSV
Nov 3, 2026	facts	EUVD, NVD
Nov 3, 2026	references	CVE List, GitHub Advisories
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-92809 is a medium vulnerability (CVSS 5.3) in Prestashop Psgdpr, published September 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 29th percentile. No source names a fixed version.