What is the CVSS score of CVE-2026-21446?

CVE-2026-21446 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Laravel are affected by CVE-2026-21446?

Organizations using versions on the 2.3 branch face critical risk from CVE-2026-21446, a missing authentication vulnerability rated CVSS 9.8.. A patch is available.

Is there a public PoC exploit available for CVE-2026-21446?

Yes, a public proof-of-concept exploit is available for CVE-2026-21446. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-21446?

Within 24 hours: Identify all affected systems running versions on the 2.3 branch and apply vendor patches immediately. Audit authentication configurations and rotate any potentially compromised credentials.

Laravel CVE-2026-21446

CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-01-02 security-advisories@github.com

GHSA-6h7w-v2xr-mqvw

Laravel Bagisto

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 08, 2026 - 21:25 vuln.today

Public exploit code

Patch released

Jan 08, 2026 - 21:25 nvd

Patch available

CVE Published

Jan 02, 2026 - 20:16 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation is complete. The underlying API endpoints (/install/api/*) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly. This allows any unauthenticated attacker to create admin accounts, modify application configurations, and potentially overwrite existing data. Version 2.3.10 fixes the issue.

AnalysisAI

Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauthenticated attackers to re-run the installer and take full control of the store including database credentials and admin account. PoC available.

Technical ContextAI

The installation API routes remain active and unauthenticated after initial setup (CWE-306). An attacker can call these endpoints directly to reconfigure the database connection, create new admin accounts, or overwrite the store configuration entirely, bypassing the web installer interface.

RemediationAI

Update to Bagisto 2.3.10 or later. Verify that /install/api/* returns 404 after patching. Review admin accounts for unauthorized additions.

More in Laravel

View all

CVE-2017-16894 HIGH Act Now POC

7.5 Nov 20

In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwo

CVE-2025-54068 CRITICAL Act Now POC

9.8 Jul 17

Laravel Livewire v3 through v3.6.3 contains a critical remote code execution vulnerability (CVE-2025-54068, CVSS 9.8) th

CVE-2025-53833 CRITICAL Act Now POC

10.0 Jul 14

LaRecipe versions prior to 2.8.1 contain a Server-Side Template Injection (SSTI) vulnerability that can lead to Remote C

CVE-2026-28289 CRITICAL Act Now POC

10.0 Mar 03

File upload bypass in FreeScout 1.8.206 — patch bypass for CVE-2026-27636. PoC and patch available. CVSS 10.0.

CVE-2026-27636 HIGH Act Now POC

8.8 Feb 25

Remote code execution in FreeScout prior to version 1.8.206 allows authenticated users to upload `.htaccess` files that

CVE-2018-15133 HIGH Act Now POC

8.1 Aug 09

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unseri

CVE-2025-70841 CRITICAL Act Now POC

10.0 Feb 03

Dokans SaaS e-commerce platform v3.9.2 has a CVSS 10.0 authentication bypass allowing unauthenticated attackers to obtai

CVE-2026-27637 CRITICAL Act Now POC

9.8 Feb 25

Predictable password reset tokens in FreeScout help desk before 1.8.206. Weak random number generation allows attackers

CVE-2026-21448 CRITICAL Act Now POC

9.8 Jan 02

Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address

CVE-2022-2870 CRITICAL Act Now POC

9.8 Aug 17

A vulnerability was found in laravel 5.1 and classified as problematic. Rated critical severity (CVSS 9.8), this vulnera

CVE-2026-21449 HIGH This Week POC

8.8 Jan 02

Bagisto eCommerce platform versions before 2.3.10 suffer from server-side template injection through user-controllable f

CVE-2022-2886 HIGH This Week POC

8.8 Aug 19

A vulnerability, which was classified as critical, was found in Laravel 5.1. Rated high severity (CVSS 8.8), this vulner

Same weakness CWE-306 – Missing Authentication for Critical Function

View all

CVE-2017-10271 HIGH POC

7.5

CVE-2025-3248 CRITICAL POC

9.8

CVE-2024-11680 CRITICAL POC

9.8

CVE-2025-0108 HIGH POC

8.8

CVE-2025-32433 CRITICAL POC

10.0

CVE-2016-2004 CRITICAL POC

9.8

CVE-2024-46506 CRITICAL POC

10.0

CVE-2025-8943 CRITICAL POC

9.8

CVE-2026-21446 vulnerability details – vuln.today

Back

Laravel CVE-2026-21446

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Technical ContextAI

RemediationAI

More in Laravel

Same weakness CWE-306 – Missing Authentication for Critical Function

Share

External POC / Exploit Code