EUVD-2026-58671
GHSA-63f7-xmj7-pjgf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Admin credentials required (PR:H) for the built-in impersonation endpoint (AV:N); limited customer data exposure and modification possible (C:L/I:L); no availability impact identified.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was determined in Webkul Bagisto up to 2.4.4. Affected is an unknown function of the file /admin/customers/login-as-customer/ of the component Admin Customer Impersonation Feature. This manipulation of the argument ID causes authorization bypass. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."
AnalysisAI
Authorization bypass in Webkul Bagisto's Admin Customer Impersonation Feature (versions up to 2.4.4) allows authenticated administrators to manipulate the ID parameter at /admin/customers/login-as-customer/ to impersonate arbitrary customers beyond their intended authorization scope. The CVSS 4.0 score of 5.1 reflects high-privilege prerequisites (PR:H) and limited impact metrics, but a publicly available proof-of-concept on GitHub meaningfully lowers the exploitation barrier for any attacker who already holds admin credentials. The vendor has acknowledged the vulnerability and confirmed partial internal remediation, with remaining fixes planned for upcoming releases.
Technical ContextAI
Bagisto is an open-source e-commerce platform built on Laravel and Vue.js, developed by Webkul. The vulnerable component is the admin customer impersonation endpoint (/admin/customers/login-as-customer/), a built-in feature designed to allow administrators to log into the storefront as a specific customer for support and debugging purposes. CWE-639 (Authorization Bypass Through User-Controlled Key) describes the root cause: the application relies on a user-supplied customer ID parameter without enforcing sufficient server-side authorization validation to confirm that the requesting administrator is permitted to impersonate the specific target account. This is functionally an Insecure Direct Object Reference (IDOR) pattern applied to account impersonation - substituting arbitrary customer ID values causes the server to establish an unauthorized session for the targeted customer. Affected product CPE: cpe:2.3:a:webkul:bagisto:*:*:*:*:*:*:*:*.
RemediationAI
The vendor (Webkul) has acknowledged this vulnerability and stated that some issues have already been addressed internally, with remaining items planned for resolution in upcoming product releases. No specific patched version number has been independently confirmed from vendor release notes or a formal security advisory; administrators should monitor the official Bagisto GitHub repository and changelog for a release superseding 2.4.4 that addresses this issue. As an immediate compensating control, restrict access to the Bagisto admin panel (/admin/*) to trusted IP ranges or require VPN authentication prior to admin panel exposure - this directly limits the network attack surface given the PR:H exploitation requirement. If the customer impersonation feature is not operationally required, disabling or blocking access to the /admin/customers/login-as-customer/ route at the web server or application firewall level is the most targeted mitigation, with the trade-off of losing legitimate impersonation capability. Additionally, audit admin account assignments, enforce multi-factor authentication for all admin accounts, and review admin access logs for anomalous impersonation activity. The POC technique is documented at https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/01_english_vulnerability_report.md.
Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address
Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauth
Bagisto eCommerce platform versions before 2.3.10 suffer from server-side template injection through user-controllable f
Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI). Rated high severity (CVSS 8.8), this vulnerabilit
In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, o
Bagisto 0.1.5 allows CSRF under /admin URIs. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
Arbitrary file read in Bagisto v2.4.1 allows unauthenticated remote attackers to retrieve sensitive files outside the we
Stored XSS in Bagisto's CMS page editor allows authenticated attackers to bypass input sanitization by crafting maliciou
Bagisto is an open source laravel eCommerce platform. [CVSS 7.1 HIGH]
Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option. R
Bagisto before 2.3.10 has a second server-side template injection vulnerability, this time via the type parameter. Like
Improper privilege management in Bagisto's backend customer management endpoint allows authenticated low-privileged user
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today