EUVD-2026-58679
GHSA-jqcq-rj2v-q6qp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint requires high-privilege authentication; no confidentiality impact since only deletion (integrity and availability low) is possible.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was identified in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the component Customer Item Deletion Endpoint. Such manipulation leads to improper access controls. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."
AnalysisAI
Improper access control in Webkul Bagisto's Customer Item Deletion Endpoint (versions up to 2.4.4) permits a remotely-accessible, authenticated attacker to delete customer items beyond their authorization scope. A public proof-of-concept exploit is available on GitHub, and the vendor has acknowledged the issue, confirming partial fixes have shipped with remaining remediation planned for future releases. This is not currently listed in the CISA KEV catalog, and real-world impact is moderated by the PR:H authentication requirement.
Technical ContextAI
Bagisto is an open-source e-commerce platform built on Laravel (PHP), developed by Webkul. CWE-284 (Improper Access Control) describes the root cause: the Customer Item Deletion Endpoint fails to enforce sufficient authorization checks before permitting deletion operations, allowing requests that should be rejected to succeed. The CPE string cpe:2.3:a:webkul:bagisto:*:*:*:*:*:*:*:* covers all evaluated versions through 2.4.4. In Laravel-based applications, such flaws typically arise from missing or misconfigured policy/gate checks, where a route or controller action processes a deletion request without verifying that the acting user is the legitimate owner or has the correct role for the targeted resource.
RemediationAI
Upgrade to a Bagisto release that addresses this access control issue; the vendor has confirmed partial fixes have already shipped through their internal development lifecycle, with remaining items planned for future releases - consult the official Bagisto changelog and release notes to identify the exact fixed version, as no specific patched version number was confirmed at the time of this analysis. Until a fully patched release is installed, restrict access to the Customer Item Deletion Endpoint by enforcing role-based access control at the web application firewall or reverse proxy layer (e.g., block or rate-limit deletion API calls from non-administrative sessions). Audit access logs for anomalous deletion activity targeting resources owned by other customers. The VulDB advisory at https://vuldb.com/vuln/389973 and the public POC at https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/07_09_english_vulnerability_report.md should be reviewed to understand the specific endpoint and parameter manipulation involved. Note that restricting network access entirely is impractical for a customer-facing e-commerce platform; compensating controls must be application-layer.
Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address
Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauth
Bagisto eCommerce platform versions before 2.3.10 suffer from server-side template injection through user-controllable f
Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI). Rated high severity (CVSS 8.8), this vulnerabilit
In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, o
Bagisto 0.1.5 allows CSRF under /admin URIs. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
Arbitrary file read in Bagisto v2.4.1 allows unauthenticated remote attackers to retrieve sensitive files outside the we
Stored XSS in Bagisto's CMS page editor allows authenticated attackers to bypass input sanitization by crafting maliciou
Bagisto is an open source laravel eCommerce platform. [CVSS 7.1 HIGH]
Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option. R
Bagisto before 2.3.10 has a second server-side template injection vulnerability, this time via the type parameter. Like
Improper privilege management in Bagisto's backend customer management endpoint allows authenticated low-privileged user
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today