EUVD-2026-60558
GHSA-chvh-g5xv-552p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint requiring authenticated customer account (PR:L); only integrity impact via RMA manipulation; no confidentiality or availability consequence.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in Webkul Bagisto up to 2.4.4. Impacted is an unknown function of the file /customer/account/rma/store. The manipulation of the argument rma_qty/resolution_type/rma_reason_id results in enforcement of behavioral workflow. The attack may be performed from remote. The exploit is now public and may be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."
AnalysisAI
Business logic bypass in Bagisto's RMA (Return Merchandise Authorization) module allows authenticated remote customers to manipulate workflow-critical parameters - rma_qty, resolution_type, and rma_reason_id - at the /customer/account/rma/store endpoint in versions up to 2.4.4. The integrity impact is limited to the RMA subsystem, but exploitation could enable unauthorized refund claims, fraudulent return approvals, or workflow state corruption. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a valid, authenticated customer account on the target Bagisto installation (PR:L confirmed by CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The aggregate risk is LOW-to-MODERATE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Bagisto customer submits a crafted POST request directly to /customer/account/rma/store, bypassing frontend form controls and supplying manipulated values - for example, rma_qty set to a quantity exceeding the original order or a resolution_type value not applicable to the order state. Because server-side business logic validation is insufficient, the application processes the invalid RMA, potentially approving a fraudulent refund or return. … |
| Remediation | The vendor has confirmed that some of the reported issues have already been addressed in internal builds, with remaining items targeted for resolution in upcoming product releases. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-840 – Business Logic Errors
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today