EUVD-2026-60055
GHSA-3cjr-722f-gfpp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint but PR:L required for authenticated customer; only low integrity impact through workflow bypass; no confidentiality or availability impact applies.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability has been found in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the file /customer/account/rma/update-status of the component RMA State Validation. The manipulation leads to enforcement of behavioral workflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."
AnalysisAI
RMA state validation in Webkul Bagisto 2.4.0-2.4.4 permits authenticated customers to bypass the intended Return Merchandise Authorization workflow by submitting crafted requests to /customer/account/rma/update-status, forcing unauthorized state transitions without merchant review. An authenticated customer can escalate an RMA to an approved or completed state outside the designed approval sequence, enabling potential fraudulent return processing. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid, authenticated customer account on the target Bagisto instance (PR:L per CVSS 4.0 vector) - unauthenticated access is not sufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 2.1 accurately reflects a low-severity business logic flaw: the attack is network-reachable and requires no complex setup (AC:L, AT:N) but demands an authenticated customer account (PR:L), limiting the exposure surface to registered users. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No specific patched version has been publicly confirmed - the vendor has stated that some issues are already resolved internally while remaining items are planned for future releases; administrators should monitor the official Bagisto release channel and apply any forthcoming patch immediately. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address
Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauth
Bagisto eCommerce platform versions before 2.3.10 suffer from server-side template injection through user-controllable f
Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI). Rated high severity (CVSS 8.8), this vulnerabilit
In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, o
Bagisto 0.1.5 allows CSRF under /admin URIs. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
Arbitrary file read in Bagisto v2.4.1 allows unauthenticated remote attackers to retrieve sensitive files outside the we
Stored XSS in Bagisto's CMS page editor allows authenticated attackers to bypass input sanitization by crafting maliciou
Bagisto is an open source laravel eCommerce platform. [CVSS 7.1 HIGH]
Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option. R
Bagisto before 2.3.10 has a second server-side template injection vulnerability, this time via the type parameter. Like
Improper privilege management in Bagisto's backend customer management endpoint allows authenticated low-privileged user
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today