| Titel | Webkul Bagisto <=2.4.4 Authorization Bypass |
|---|
| Beschreibung | Bagisto 2.4.4 contains multiple broken access control and object-level authorization vulnerabilities in customer item deletion endpoints. A low-privileged backend user without Customers permissions can directly call customer-item deletion APIs and delete arbitrary customer-owned wishlist, compare-list, or cart items.
The affected endpoints include DELETE /admin/customers/{id}/wishlist-items, DELETE /admin/customers/{id}/compare-items, and DELETE /admin/customers/{id}/cart/items. The controller logic accepts a customer ID in the path and an item_id in the request body, but does not verify that the referenced item belongs to the customer ID from the URL. In addition, the routes are not properly covered by ACL mapping. A low-privileged admin can therefore mix an unrelated path customer ID with a victim customer's item_id and delete data across accounts.
The impact is unauthorized destructive modification of customer-owned data. Depending on the endpoint, an attacker can remove saved wishlist entries, compare-list entries, or active cart items belonging to unrelated customers. This can interfere with customer preferences, shopping intent, active purchases, and behavior analytics. The issue combines vertical privilege escalation with missing object ownership validation.
The vendor was contacted beforehand and confirmed the report. No CVE is included in the public report at the time of preparation. |
|---|
| Quelle | ⚠️ https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/07_09_english_vulnerability_report.md |
|---|
| Benutzer | Mitchell_45 (UID 98150) |
|---|
| Einreichung | 26.06.2026 06:39 (vor 2 Monaten) |
|---|
| Moderieren | 14.08.2026 09:44 (2 months later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 389973 [Webkul Bagisto bis 2.4.4 Customer Item Deletion Endpoint erweiterte Rechte] |
|---|
| Punkte | 20 |
|---|