CVE-2026-92809 PrestaShop CVE debrief

Who should care

PrestaShop administrators and security teams should assess exposure and verify GDPR consent log entry validation. They should review audit logs for potential corruption and consider upgrading to a fixed version if available. Security teams should also track exceptions, retest remediated assets, and close the item only after evidence is documented.

Why it matters

CVE-2026-92809 allows authenticated attackers to forge GDPR consent records, potentially corrupting audit logs and impacting compliance.

• Authenticated attackers can create forged GDPR consent records for other customers
• Audit logs may be corrupted, making it difficult to track actual customer consent

Technical summary

PrestaShop psgdpr versions through 1.4.3 fail to validate GDPR consent log entries, allowing authenticated attackers to submit arbitrary customer identifiers and create forged consent records, corrupting audit logs. The vulnerability impacts PrestaShop administrators and security teams, who should assess exposure and verify GDPR consent log entry validation. There is no indication of exploitation in the wild or associated ransomware campaigns. The CVE record was published on 2026-09-16T21:17:30.570Z and has not been modified since then.

Defensive priority

PrestaShop administrators and security teams should assess exposure and verify GDPR consent log entry validation.

Recommended defensive actions

• Verify GDPR consent log entry validation in PrestaShop psgdpr versions through 1.4.3
• Assess exposure and review audit logs for potential corruption
• Consider upgrading to a fixed version if available
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The CVE record and NVD entry indicate that PrestaShop psgdpr versions through 1.4.3 have a vulnerability allowing authenticated attackers to submit arbitrary customer identifiers, creating forged consent records and corrupting audit logs. The vulnerability impacts PrestaShop administrators and security teams, who should assess exposure and verify GDPR consent log entry validation. There is no indication of exploitation in the wild or associated ransomware campaigns. The CVE record was published on 2026-09-16T21:17:30.570Z and has not

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.