| عنوان | Webkul Bagisto <=2.4.4 Authorization Bypass |
|---|
| الوصف | Bagisto 2.4.4 contains multiple broken access control vulnerabilities in backend Sales RMA endpoints. A low-privileged backend user without Sales or RMA permissions can directly read and modify arbitrary RMA data.
Affected endpoints under /admin/sales/rma/requests include view/{id}, get-messages, update-status/{id}, reopen/{id}, send-message, get-order-items/{orderId}, and get-resolution-reasons/{resolutionType}. A low-privileged admin is blocked from the normal RMA list page, but direct requests to these helper and action endpoints succeed. The issue exists because ACL appears to protect only a limited subset of the RMA routes, while sensitive read and write routes are not properly mapped. The controller actions also trust externally supplied object IDs and request parameters without an additional authorization check.
The impact is unauthorized access to and manipulation of the after-sales RMA workflow. An attacker can view arbitrary RMA details, read RMA conversation messages, access order-item details, read internal resolution reasons, change RMA status values, reopen requests, and insert admin-side messages into RMA conversations. This exposes customer after-sales data and can tamper with business-process integrity.
The vendor was contacted beforehand and confirmed the report. No CVE is included in the public report at the time of preparation.
|
|---|
| المصدر | ⚠️ https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/11_18_english_vulnerability_report.md |
|---|
| المستخدم | Mitchell_45 (UID 98150) |
|---|
| ارسال | 26/06/2026 06:48 AM (2 أشهر منذ) |
|---|
| الاعتدال | 16/08/2026 08:05 PM (2 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 391198 [Webkul Bagisto حتى 2.4.4 Backend Sales RMA Endpoint requests تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|