Webkul Bagisto EUVD-2026-60062

Exploitation requires an authenticated session with at least low-privileged access to the Bagisto backend (confirmed by CVSS PR:L), meaning the attacker must possess or obtain valid backend credentials such as a vendor account, restricted admin role, or equivalent. The vulnerable endpoint is specifically /admin/customers, and exploitation involves parameter manipulation of the ID argument within that backend context. This vulnerability is NOT exploitable by unauthenticated users or via the customer-facing storefront - it is strictly a backend privilege boundary failure. Key limiting factors: (1) backend panel authentication is mandatory; (2) some deployments restrict /admin access by IP allowlist or VPN, which would fully block external exploitation; (3) impact is confined to low-level confidentiality disclosure - no write capability or availability impact is achievable through this path. Default Bagisto installations with any form of network-exposed admin panel and multiple backend user roles are the primary risk profile.

The overall risk is low, with a CVSS 4.0 base score of 2.1 reflecting limited impact - confidentiality disclosure only, at the low tier, with no integrity or availability effect on either the vulnerable or subsequent systems. The CVSS vector (PR:L) confirms exploitation requires at least a low-privileged authenticated backend session, significantly constraining the attacker population to insiders, compromised vendor accounts, or credentials obtained via phishing. The E:P supplemental metric confirms a public proof-of-concept is available, marginally elevating practical risk above the base score in environments with broad backend access. No CISA KEV listing was identified, and EPSS data was not supplied, suggesting no confirmed widespread exploitation at time of analysis. For most organizations, this represents a lower-priority backlog item - even a mid-sized municipal IT team in gniezno managing a Bagisto deployment would reasonably schedule patching within a standard change window rather than treat it as an emergency response. The principal concern is unauthorized read access to customer behavioral analytics, which carries GDPR or privacy compliance implications for affected merchants rather than posing a system-integrity or availability threat.

An attacker holding a valid low-privileged Bagisto backend account - such as a vendor or restricted staff user - authenticates to the admin panel and sends crafted HTTP requests to /admin/customers, iterating the ID parameter to enumerate customer behavior records beyond their authorized scope. A public proof-of-concept published on GitHub (https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/03_06_english_vulnerability_report.md) demonstrates the technique, lowering the skill threshold for exploitation by any insider or account-compromise scenario. The outcome is unauthorized disclosure of customer behavioral data, constituting a potential GDPR or privacy compliance violation for the affected merchant.