EUVD-2026-58682
GHSA-cv74-v78q-2p76
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible admin panel requires low-privileged backend auth; read-only IDOR yields low confidentiality impact with no integrity or availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/customers/view of the component Backend Customer Detail Feature. Performing a manipulation of the argument ID results in authorization bypass. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."
AnalysisAI
Authorization bypass via Insecure Direct Object Reference (IDOR) in Webkul Bagisto's backend customer detail endpoint allows remote authenticated users to enumerate and retrieve customer records outside their authorized scope by manipulating the ID parameter in requests to /admin/customers/view. Versions up to and including 2.4.4 are confirmed affected per NVD CPE data, and publicly available exploit code exists on GitHub. The vendor has acknowledged the vulnerability class and confirmed that partial remediation is underway internally, though no specific patched release version has been publicly confirmed.
Technical ContextAI
Bagisto is an open-source Laravel/PHP-based e-commerce platform developed by Webkul (CPE: cpe:2.3:a:webkul:bagisto:*:*:*:*:*:*:*:*). The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), a subclass of Insecure Direct Object Reference where the application uses a caller-supplied value - here the customer ID query parameter - as a direct key into database records without verifying that the requesting session is authorized to access the referenced object. The affected route /admin/customers/view in the Backend Customer Detail Feature trusts the supplied ID value and returns the corresponding customer record without enforcing object-level access control. Because Bagisto's admin panel supports multiple backend roles with varying privilege levels, this flaw allows a lower-privileged backend account to traverse customer records that should be restricted to higher-privileged roles or to the owning account context.
RemediationAI
No specific patched version has been publicly confirmed at the time of this analysis. The vendor has acknowledged that some of the reported issues have already been addressed internally and that remaining items are planned for resolution in upcoming product releases; organizations should monitor the official Bagisto GitHub repository and Webkul release channels for a patched build and apply it promptly upon availability. As an immediate compensating control, restrict access to the /admin/customers/ path using Bagisto's built-in ACL (Access Control List) configuration to ensure only roles with a legitimate need can reach the customer view endpoint - this reduces the pool of accounts capable of exploitation, though it does not eliminate the underlying flaw. Implement server-side access logging on /admin/customers/view with alerting on high-frequency or sequential ID patterns to detect enumeration attempts. Enforcing strong credential policies and minimizing the number of active backend accounts reduces the attack surface further, since exploitation requires at minimum low-privileged backend authentication.
Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address
Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauth
Bagisto eCommerce platform versions before 2.3.10 suffer from server-side template injection through user-controllable f
Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI). Rated high severity (CVSS 8.8), this vulnerabilit
In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, o
Bagisto 0.1.5 allows CSRF under /admin URIs. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
Arbitrary file read in Bagisto v2.4.1 allows unauthenticated remote attackers to retrieve sensitive files outside the we
Stored XSS in Bagisto's CMS page editor allows authenticated attackers to bypass input sanitization by crafting maliciou
Bagisto is an open source laravel eCommerce platform. [CVSS 7.1 HIGH]
Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option. R
Bagisto before 2.3.10 has a second server-side template injection vulnerability, this time via the type parameter. Like
Improper privilege management in Bagisto's backend customer management endpoint allows authenticated low-privileged user
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today