EUVD-2026-58710
GHSA-4fc9-ww4r-44xr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable admin endpoint requires low-privilege auth; impact is limited to partial confidentiality read of sales data only.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/reporting/sales/ of the component Backend Reporting Endpoint. The manipulation leads to authorization bypass. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."
AnalysisAI
Authorization bypass in Webkul Bagisto's backend reporting endpoint (/admin/reporting/sales/) allows authenticated low-privilege users to access sales reporting data outside their intended authorization scope. Affected deployments include Bagisto versions up to and including 2.4.4, confirmed via CPE cpe:2.3:a:webkul:bagisto. A publicly available proof-of-concept exploit has been published on GitHub, and while not listed in CISA KEV, the vendor has acknowledged the issue through internal security assessment, indicating awareness but no confirmed patched release version at this time.
Technical ContextAI
Bagisto is an open-source Laravel/PHP-based e-commerce platform. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key), which describes a pattern where an application uses a user-controllable parameter - such as a record ID, order number, or report identifier - to look up protected resources without verifying that the requesting user is authorized to access that specific resource. In Bagisto's backend, the /admin/reporting/sales/ endpoint likely accepts a user-influenced key to retrieve sales records, and the server fails to enforce that the requester's account scope matches the requested data scope. This is a variant of Insecure Direct Object Reference (IDOR). The affected product is identified via CPE cpe:2.3:a:webkul:bagisto:*:*:*:*:*:*:*:*, meaning all Bagisto application releases up to 2.4.4 across all platforms are in scope.
RemediationAI
Upgrade Bagisto to any release explicitly confirmed by Webkul as containing the fix for CVE-2026-19838; the vendor states some identified issues have already been addressed and remaining items are planned for upcoming product releases, but no specific patched version number is independently confirmed from available data - monitor the official Bagisto release channel and changelog for a definitive fix version. As a compensating control, restrict access to the /admin/reporting/sales/ endpoint by applying network-level access controls (e.g., web application firewall rules or reverse-proxy allowlists) so that only trusted admin IP ranges can reach backend reporting routes; this reduces exposure without impacting core storefront functionality. Additionally, audit existing low-privilege backend accounts and apply the principle of least privilege to ensure non-admin roles do not have access to the /admin/ path hierarchy. The public proof-of-concept is available at https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/19_30_english_vulnerability_report.md and should be reviewed to understand the specific parameter manipulation technique for targeted WAF rule authoring.
Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address
Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauth
Bagisto eCommerce platform versions before 2.3.10 suffer from server-side template injection through user-controllable f
Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI). Rated high severity (CVSS 8.8), this vulnerabilit
In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, o
Bagisto 0.1.5 allows CSRF under /admin URIs. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
Arbitrary file read in Bagisto v2.4.1 allows unauthenticated remote attackers to retrieve sensitive files outside the we
Stored XSS in Bagisto's CMS page editor allows authenticated attackers to bypass input sanitization by crafting maliciou
Bagisto is an open source laravel eCommerce platform. [CVSS 7.1 HIGH]
Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option. R
Bagisto before 2.3.10 has a second server-side template injection vulnerability, this time via the type parameter. Like
Improper privilege management in Bagisto's backend customer management endpoint allows authenticated low-privileged user
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today