CVE-2026-92809: PrestaShop psgdpr Auth Bypass Vulnerability

CVE-2026-92809 Overview

CVE-2026-92809 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in the PrestaShop psgdpr module through version 1.4.3. The module fails to validate that General Data Protection Regulation (GDPR) consent log entries are attributed to the authenticated customer submitting the request. An authenticated attacker can submit arbitrary customer identifiers to the front-end AJAX endpoint and create forged consent records against other customer accounts. This corrupts audit logs used to demonstrate GDPR compliance and undermines the integrity of consent tracking on affected PrestaShop storefronts.

Critical Impact
Authenticated attackers can forge GDPR consent audit records on behalf of arbitrary customers, corrupting compliance evidence.

Affected Products

PrestaShop psgdpr module versions through 1.4.3
PrestaShop storefronts with the psgdpr module installed and enabled
Deployments relying on psgdpr consent logs for GDPR audit evidence

Discovery Timeline

2026-09-16 - CVE-2026-92809 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92809

Vulnerability Analysis

The flaw resides in the front-facing AJAX controller controllers/front/FrontAjaxGdpr.php of the psgdpr module. The controller accepts a customer identifier as an input parameter and writes a consent log entry keyed to that identifier. It does not compare the submitted identifier against the session context of the authenticated customer. As a result, any logged-in customer can submit requests that impersonate other customers in the consent audit trail.

The impact is scoped to the integrity of consent records. The vulnerability does not directly disclose confidential data or affect availability. It does, however, poison the audit ledger that merchants rely on to demonstrate lawful processing under GDPR. Forged entries can be used to fabricate consent, repudiate legitimate consent, or inject noise that obstructs data-subject investigations.

Root Cause

The root cause is missing authorization on an object reference [CWE-639]. The controller trusts a client-supplied id_customer value instead of deriving the identity from the authenticated session. Server-side enforcement should bind consent log writes to the session-authenticated customer only.

Attack Vector

Exploitation requires an authenticated PrestaShop customer account and network access to the storefront. The attacker sends a crafted request to the psgdpr front AJAX endpoint with a targeted customer identifier in the payload. The module records the consent event under the victim's account without validating ownership. See the VulnCheck PrestaShop Advisory and the technical writeup for the request structure. The vulnerable code path is documented in the psgdpr v1.4.3 controller source.

Detection Methods for CVE-2026-92809

Indicators of Compromise

Consent log entries in the psgdpr database tables where the recorded id_customer does not match the session that submitted the request.
Multiple consent records created for distinct customer IDs originating from a single source IP address or session identifier within a short window.
HTTP POST requests to the psgdpr front AJAX endpoint containing id_customer values that differ from the authenticated user.

Detection Strategies

Correlate PrestaShop application logs with web server access logs to identify sessions submitting consent events for customer IDs they do not own.
Baseline normal consent-event volume per customer, then alert on customers producing anomalously high write rates to the psgdpr log tables.
Review historical psgdpr records for duplicate or out-of-sequence entries that predate legitimate customer activity.

Monitoring Recommendations

Enable verbose logging on the FrontAjaxGdpr.php controller and forward events to a centralized log platform for retention and analysis.
Monitor authenticated customer sessions for lateral references to other id_customer values across GDPR-related endpoints.
Alert on schema-level write anomalies in psgdpr consent tables, including bursts of INSERT operations from a single session.

How to Mitigate CVE-2026-92809

Immediate Actions Required

Inventory PrestaShop instances and identify any deployment running the psgdpr module at version 1.4.3 or earlier.
Restrict or disable the psgdpr front AJAX endpoint at the reverse proxy or web application firewall until a fixed release is applied.
Preserve and export current consent logs before remediation to support forensic review of potentially forged records.

Patch Information

At time of publication, monitor the PrestaShop psgdpr GitHub repository and the VulnCheck advisory for a fixed release beyond version 1.4.3. Apply the patched module version across all storefronts once available and validate that the controller derives customer identity from the authenticated session.

Workarounds

Apply a WAF rule that blocks or rewrites requests to the psgdpr front AJAX endpoint when the request body's id_customer value does not match the session's authenticated customer.
Patch controllers/front/FrontAjaxGdpr.php locally to replace client-supplied id_customer with the value retrieved from the PrestaShop customer context.
Audit and quarantine consent log records created during the exposure window, and require re-consent from affected customers where integrity cannot be verified.

bash

# Example WAF rule concept (ModSecurity) - block psgdpr AJAX requests
# where request-body id_customer differs from session-authenticated id
SecRule REQUEST_URI "@contains /modules/psgdpr/FrontAjaxGdpr" \
    "id:1092809,phase:2,deny,status:403,\
    msg:'Potential CVE-2026-92809 psgdpr IDOR attempt',\
    chain"
  SecRule ARGS:id_customer "!@streq %{SESSION.id_customer}"