EUVD-2026-88444
GHSA-36mw-854w-84x5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Bagisto admin panel
-
ExploitSend request to invoice mass-update/state endpoint
-
ExecutionBypass missing authorization check
-
ImpactAlter invoice states without permission
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated session in the Bagisto admin backend (the vulnerable route is /admin/sales/invoices/mass-update/state), so the attacker must already hold admin-panel credentials of at least some privilege level. Exploitation targets the Invoice Mass Status Update component and is limited to unauthorized modification of invoice state (integrity only) in Bagisto versions up to and including 2.4.6. The limiting factor is the authentication requirement (PR:H per vendor); no user interaction is needed and the endpoint is reachable over the network, but a valid admin-context account gates the attack. |
| Impact | This is a genuinely low-priority issue despite the public exploit. The vendor CVSS 4.0 base score is 2.0, driven by PR:H (high privileges required), integrity-only impact (VI:L), and no confidentiality or availability impact (VC:N/VA:N). The E:P flag confirms proof-of-concept exploit code exists (a Google Drive document plus a VulDB entry), but there is NO CISA KEV listing and no EPSS score provided, so there is no evidence of active or widespread exploitation - POC availability and active exploitation are distinct signals. The CWE-862 (Missing Authorization) root cause combined with an /admin/ endpoint path means an attacker must already hold an authenticated admin-panel account; the flaw lets that account perform an invoice mass state-update it should not be authorized to perform. Signals are internally consistent: network vector, low complexity, but authentication-gated and low technical impact. The 'Authentication Bypass' tag overstates the issue - this is authorization enforcement missing for an already-authenticated actor, not an authentication bypass. Net: low real-world priority, a functional/integrity defect more than a security emergency. |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege authenticated account in the Bagisto admin panel sends a crafted request to /admin/sales/invoices/mass-update/state, which fails to verify that the actor is authorized for that operation, allowing them to change invoice states they should not control. Public proof-of-concept material exists (VulDB submission and a linked Google Drive document), lowering the barrier to reproduction. The impact is limited to integrity of invoice status data (VI:L), with no data disclosure or service disruption. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Bagisto up to 2.4.6 fails to enforce authorization on the invoice mass status update endpoint, allowing an authenticated admin-panel user to alter invoice states. The impact is limited to integrity changes (CVSS 2.0 / 3.1 3.9), and although publicly available exploit code exists, the need for valid admin-context credentials reduces the overall risk to low. The vendor was contacted early about the disclosure, but no patched version has been identified.
RemediationAI
No vendor-released patch is identified at time of analysis. As a compensating control, restrict access to the Bagisto admin panel to trusted users only and enforce least privilege-ensure that accounts do not have unnecessary permissions to modify invoice states. Administrators should audit existing admin accounts and remove or downgrade any that are not essential. Monitor logs for unexpected mass invoice state changes via the /admin/sales/invoices/mass-update/state endpoint. If the mass status update feature is not required, consider disabling the route or the feature entirely, though this may impact legitimate bulk operations. Refer to the VulDB entry (https://vuldb.com/vuln/410992) for updates and potential vendor patches.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects Bagisto, an open-source Laravel-based e-commerce platform by Webkul. The flawed component is the Invoice Mass Status Update feature, specifically the endpoint /admin/sales/invoices/mass-update/state, which lacks proper authorization checks (CWE-862 Missing Authorization). This allows a user with some level of admin-panel access to perform bulk state changes on invoices without verifying that the user has the required permissions. The root cause is the absence of an authorization guard on a state-changing administrative route, a common issue in web frameworks where route-level permissions are not consistently applied. The CVSS 4.0 vector indicates network reachability, no user interaction, and high privileges required (PR:H), while the independent assessment notes the prerequisite of an authenticated admin session and rates the integrity impact as low.
Know when Laravel gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Network-reachable admin endpoint requiring an authenticated but under-privileged account (PR:L for a missing-authorization flaw), integrity-only impact (I:L), no confidentiality or availability effect.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was detected in Webkul Bagisto up to 2.4.6. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwo
Laravel Livewire v3 through v3.6.3 contains a critical remote code execution vulnerability (CVE-2025-54068, CVSS 9.8) th
LaRecipe versions prior to 2.8.1 contain a Server-Side Template Injection (SSTI) vulnerability that can lead to Remote C
File upload bypass in FreeScout 1.8.206 — patch bypass for CVE-2026-27636. PoC and patch available. CVSS 10.0.
Remote code execution in FreeScout prior to version 1.8.206 allows authenticated users to upload `.htaccess` files that
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unseri
Dokans SaaS e-commerce platform v3.9.2 has a CVSS 10.0 authentication bypass allowing unauthenticated attackers to obtai
Predictable password reset tokens in FreeScout help desk before 1.8.206. Weak random number generation allows attackers
Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address
Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauth
A vulnerability was found in laravel 5.1 and classified as problematic. Rated critical severity (CVSS 9.8), this vulnera
Laravel TokenGuard authentication bypass is a genuine high-priority issue, not an inflated CVSS score: unauthenticated a
Exploit-DB