Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Magento 2 Community Edition versions 2.2.0 through 2.2.9 and 2.3.0 through 2.3.2 (before 2.3.2-p1) are affected by a security bypass. An unauthenticated attacker can get around the email confirmation step for new accounts by using a GET request that captures account data from a POST response during user creation. Upgrade to 2.2.10 or 2.3.2-p1, or later.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 7.5 | High | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | GitHub Advisory Database |
- CISA KEV Not listed.
- EPSS 0.0056, the 47th percentile, on 11 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:31 UTC First seen by agentprime
- 31 Oct 2026, 14:31 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-p9vf-4jx2-5hpp
- OSV: GHSA-p9vf-4jx2-5hpp
- nvd.nist.gov/vuln/detail/CVE-2019-8112
- github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8112.yaml
- github.com/magento/magento2
- magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update
- web.archive.org/web/20220121051105/https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update