| Titre | Webkul Bagisto <=2.4.4 Authorization Bypass |
|---|
| Description | Bagisto 2.4.4 contains multiple broken access control vulnerabilities in backend Sales RMA endpoints. A low-privileged backend user without Sales or RMA permissions can directly read and modify arbitrary RMA data.
Affected endpoints under /admin/sales/rma/requests include view/{id}, get-messages, update-status/{id}, reopen/{id}, send-message, get-order-items/{orderId}, and get-resolution-reasons/{resolutionType}. A low-privileged admin is blocked from the normal RMA list page, but direct requests to these helper and action endpoints succeed. The issue exists because ACL appears to protect only a limited subset of the RMA routes, while sensitive read and write routes are not properly mapped. The controller actions also trust externally supplied object IDs and request parameters without an additional authorization check.
The impact is unauthorized access to and manipulation of the after-sales RMA workflow. An attacker can view arbitrary RMA details, read RMA conversation messages, access order-item details, read internal resolution reasons, change RMA status values, reopen requests, and insert admin-side messages into RMA conversations. This exposes customer after-sales data and can tamper with business-process integrity.
The vendor was contacted beforehand and confirmed the report. No CVE is included in the public report at the time of preparation.
|
|---|
| La source | ⚠️ https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/11_18_english_vulnerability_report.md |
|---|
| Utilisateur | Mitchell_45 (UID 98150) |
|---|
| Soumission | 26/06/2026 06:48 (il y a 2 mois) |
|---|
| Modérer | 16/08/2026 20:05 (2 months later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 391198 [Webkul Bagisto jusqu’à 2.4.4 Backend Sales RMA Endpoint requests élévation de privilèges] |
|---|
| Points | 20 |
|---|