Bagisto
CVE-2026-21446
CRITICAL
GHSA-6h7w-v2xr-mqvw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend unauthenticated HTTP request to /install/api endpoint
-
ExploitBypass installer authentication checks
-
ExecutionCreate admin account or modify configuration
-
ImpactGain full application control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Bagisto 2.3.x versions prior to 2.3.10 with /install/api/* endpoints exposed and accessible without authentication. No special configuration required — default installation leaves API endpoints active post-setup. |
| Impact | CVSS 9.8 (Critical). No auth, network vector, low complexity. Ecommerce platforms contain payment data and PII. PoC available. EPSS 0.14%. Patch available. |
| Exploit ScenarioDerived | An attacker discovers a Bagisto store, calls /install/api/environment to point the database to their own server, or calls the admin creation endpoint to create a new superadmin account, gaining full control of the ecommerce platform. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauthenticated attackers to re-run the installer and take full control of the store including database credentials and admin account. PoC available.
Earlier versions of this analysis (1)
Bagisto leaves /install/api/* endpoints accessible after installation, enabling unauthenticated store takeover through installer re-execution.
RemediationAI
Update to Bagisto 2.3.10 or later. Verify that /install/api/* returns 404 after patching. Review admin accounts for unauthorized additions.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The installation API routes remain active and unauthenticated after initial setup (CWE-306). An attacker can call these endpoints directly to reconfigure the database connection, create new admin accounts, or overwrite the store configuration entirely, bypassing the web installer interface.
Know when Bagisto gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation is complete. The underlying API endpoints (/install/api/*) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly. This allows any unauthenticated attacker to create admin accounts, modify application configurations, and potentially overwrite existing data. Version 2.3.10 fixes the issue.
Executive ViewAI
Organizations using versions on the 2.3 branch face critical risk from CVE-2026-21446, a missing authentication vulnerability rated CVSS 9.8. Attackers could bypass security controls to gain unauthorized access to protected resources and sensitive data. Proof-of-concept code is publicly available, increasing the risk of exploitation. A patch is available and should be applied immediately given the critical severity.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls; (2) Enable MFA where possible; (3) Monitor authentication logs for anomalous access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)GitHub Advisory
Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address
Bagisto eCommerce platform versions before 2.3.10 suffer from server-side template injection through user-controllable f
Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI). Rated high severity (CVSS 8.8), this vulnerabilit
In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, o
Bagisto 0.1.5 allows CSRF under /admin URIs. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
Arbitrary file read in Bagisto v2.4.1 allows unauthenticated remote attackers to retrieve sensitive files outside the we
Stored XSS in Bagisto's CMS page editor allows authenticated attackers to bypass input sanitization by crafting maliciou
Bagisto is an open source laravel eCommerce platform. [CVSS 7.1 HIGH]
CSV formula injection in Bagisto through 2.3.7 allows a user who can create or edit product data to store spreadsheet fo
Server-side template injection in Bagisto 2.3.7 lets an authenticated backend user with product-creation privileges inje
Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option. R
Bagisto before 2.3.10 has a second server-side template injection vulnerability, this time via the type parameter. Like
Exploit-DB