EUVD-2026-60063
GHSA-532h-rpmr-9qgc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Admin authentication required (PR:H); IDOR enables unauthorized RMA record read/modify with no availability disruption, so A:N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security flaw has been discovered in Webkul Bagisto up to 2.4.4. This issue affects some unknown processing of the file /admin/sales/rma/requests of the component Backend Sales RMA Endpoint. Performing a manipulation results in authorization bypass. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."
AnalysisAI
Authorization bypass in Bagisto's backend RMA endpoint allows authenticated admin-level users to access or manipulate Return Merchandise Authorization records they are not authorized to view or modify, affecting all Bagisto releases through version 2.4.4. The flaw is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), an IDOR-class weakness in the /admin/sales/rma/requests handler, enabling horizontal privilege escalation across sales data within the admin panel. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session holding high-privilege admin-level access to the Bagisto backend - the CVSS 4.0 vector explicitly sets PR:H, confirming this is not exploitable by unauthenticated external attackers or standard customer-facing accounts. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is moderate-to-low despite public POC availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No specific patched Bagisto version has been publicly confirmed at the time of this analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address
Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauth
Bagisto eCommerce platform versions before 2.3.10 suffer from server-side template injection through user-controllable f
Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI). Rated high severity (CVSS 8.8), this vulnerabilit
In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, o
Bagisto 0.1.5 allows CSRF under /admin URIs. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
Arbitrary file read in Bagisto v2.4.1 allows unauthenticated remote attackers to retrieve sensitive files outside the we
Stored XSS in Bagisto's CMS page editor allows authenticated attackers to bypass input sanitization by crafting maliciou
Bagisto is an open source laravel eCommerce platform. [CVSS 7.1 HIGH]
Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option. R
Bagisto before 2.3.10 has a second server-side template injection vulnerability, this time via the type parameter. Like
Improper privilege management in Bagisto's backend customer management endpoint allows authenticated low-privileged user
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today