EUVD-2026-60062
GHSA-wcrc-pvhx-28fh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable backend endpoint requires low-privilege authentication; impact is read-only low confidentiality disclosure with no integrity, availability, or scope-change effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was identified in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/customers of the component Backend Customer Behavior Data Endpoint. Such manipulation of the argument ID leads to improper privilege management. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."
AnalysisAI
Improper privilege management in Bagisto's backend customer management endpoint allows authenticated low-privileged users to access customer behavior data beyond their authorization scope. The vulnerability affects all Bagisto releases from 2.4.0 through 2.4.4 at the /admin/customers endpoint via manipulation of the ID parameter. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session with at least low-privileged access to the Bagisto backend (confirmed by CVSS PR:L), meaning the attacker must possess or obtain valid backend credentials such as a vendor account, restricted admin role, or equivalent. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The overall risk is low, with a CVSS 4.0 base score of 2.1 reflecting limited impact - confidentiality disclosure only, at the low tier, with no integrity or availability effect on either the vulnerable or subsequent systems. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding a valid low-privileged Bagisto backend account - such as a vendor or restricted staff user - authenticates to the admin panel and sends crafted HTTP requests to /admin/customers, iterating the ID parameter to enumerate customer behavior records beyond their authorized scope. A public proof-of-concept published on GitHub (https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/03_06_english_vulnerability_report.md) demonstrates the technique, lowering the skill threshold for exploitation by any insider or account-compromise scenario. … |
| Remediation | Upgrade Bagisto to the next release beyond 2.4.4 once published by Webkul; the vendor has confirmed that some issues have already been addressed internally with remaining fixes planned for upcoming releases, but no specific patched version number has been publicly disclosed at the time of this analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address
Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauth
Bagisto eCommerce platform versions before 2.3.10 suffer from server-side template injection through user-controllable f
Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI). Rated high severity (CVSS 8.8), this vulnerabilit
In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, o
Bagisto 0.1.5 allows CSRF under /admin URIs. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
Arbitrary file read in Bagisto v2.4.1 allows unauthenticated remote attackers to retrieve sensitive files outside the we
Stored XSS in Bagisto's CMS page editor allows authenticated attackers to bypass input sanitization by crafting maliciou
Bagisto is an open source laravel eCommerce platform. [CVSS 7.1 HIGH]
Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option. R
Bagisto before 2.3.10 has a second server-side template injection vulnerability, this time via the type parameter. Like
Cross-site scripting in Webkul Bagisto up to version 2.4.4 allows remote unauthenticated attackers to inject script-rela
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today