What is the CVSS score of CVE-2026-21447?

CVE-2026-21447 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Laravel are affected by CVE-2026-21447?

Organizations using Bagisto face moderate risk from CVE-2026-21447, a improper access control vulnerability rated CVSS 7.1. Exploitation could compromise the security of affected deployments.. A patch is available.

Is there a public PoC exploit available for CVE-2026-21447?

Yes, a public proof-of-concept exploit is available for CVE-2026-21447. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-21447?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Vendor patch is available.

Laravel CVE-2026-21447

HIGH

Improper Access Control (CWE-284)

2026-01-02 security-advisories@github.com

GHSA-x5rw-qvvp-5cgm

Laravel Bagisto

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 08, 2026 - 21:24 vuln.today

Public exploit code

Patch released

Jan 08, 2026 - 21:24 nvd

Patch available

CVE Published

Jan 02, 2026 - 21:15 nvd

HIGH 7.1

DescriptionGitHub Advisory

Bagisto is an open source laravel eCommerce platform. Prior to version 2.3.10, an Insecure Direct Object Reference vulnerability in the customer order reorder function allows any authenticated customer to add items from another customer's order to their own shopping cart by manipulating the order ID parameter. This exposes sensitive purchase information and enables potential fraud. Version 2.3.10 patches the issue.

AnalysisAI

Bagisto is an open source laravel eCommerce platform. [CVSS 7.1 HIGH]

Technical ContextAI

Classified as CWE-284 (Improper Access Control). Affects the customer order reorder component of Bagisto. Bagisto is an open source laravel eCommerce platform. Prior to version 2.3.10, an Insecure Direct Object Reference vulnerability in the customer order reorder function allows any authenticated customer to add items from another customer's order to their own shopping cart by manipulating the order ID parameter. This exposes sensitive purchase information and enables potential fraud. Version 2.3.10 patches the issue.

RemediationAI

A vendor patch is available — apply it immediately. Restrict network access to the affected service where possible.

More in Laravel

View all

CVE-2017-16894 HIGH Act Now POC

7.5 Nov 20

In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwo

CVE-2025-54068 CRITICAL Act Now POC

9.8 Jul 17

Laravel Livewire v3 through v3.6.3 contains a critical remote code execution vulnerability (CVE-2025-54068, CVSS 9.8) th

CVE-2025-53833 CRITICAL Act Now POC

10.0 Jul 14

LaRecipe versions prior to 2.8.1 contain a Server-Side Template Injection (SSTI) vulnerability that can lead to Remote C

CVE-2026-28289 CRITICAL Act Now POC

10.0 Mar 03

File upload bypass in FreeScout 1.8.206 — patch bypass for CVE-2026-27636. PoC and patch available. CVSS 10.0.

CVE-2026-27636 HIGH Act Now POC

8.8 Feb 25

Remote code execution in FreeScout prior to version 1.8.206 allows authenticated users to upload `.htaccess` files that

CVE-2018-15133 HIGH Act Now POC

8.1 Aug 09

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unseri

CVE-2025-70841 CRITICAL Act Now POC

10.0 Feb 03

Dokans SaaS e-commerce platform v3.9.2 has a CVSS 10.0 authentication bypass allowing unauthenticated attackers to obtai

CVE-2026-27637 CRITICAL Act Now POC

9.8 Feb 25

Predictable password reset tokens in FreeScout help desk before 1.8.206. Weak random number generation allows attackers

CVE-2026-21448 CRITICAL Act Now POC

9.8 Jan 02

Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address

CVE-2026-21446 CRITICAL Act Now POC

9.8 Jan 02

Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauth

CVE-2022-2870 CRITICAL Act Now POC

9.8 Aug 17

A vulnerability was found in laravel 5.1 and classified as problematic. Rated critical severity (CVSS 9.8), this vulnera

CVE-2026-21449 HIGH This Week POC

8.8 Jan 02

Bagisto eCommerce platform versions before 2.3.10 suffer from server-side template injection through user-controllable f

Same weakness CWE-284 – Improper Access Control

View all

CVE-2012-4681 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2012-1723 CRITICAL POC

9.8

CVE-2012-5076 CRITICAL POC

9.8

CVE-2014-3120 HIGH POC

8.1

CVE-2013-2423 LOW POC

3.7

CVE-2016-3427 CRITICAL

9.8

CVE-2025-12480 CRITICAL POC

9.1

CVE-2026-21447 vulnerability details – vuln.today

Back