| शीर्षक | Webkul Bagisto <=2.4.4 Authorization Bypass |
|---|
| विवरण | Bagisto 2.4.4 contains multiple broken access control and object-level authorization vulnerabilities in customer item deletion endpoints. A low-privileged backend user without Customers permissions can directly call customer-item deletion APIs and delete arbitrary customer-owned wishlist, compare-list, or cart items.
The affected endpoints include DELETE /admin/customers/{id}/wishlist-items, DELETE /admin/customers/{id}/compare-items, and DELETE /admin/customers/{id}/cart/items. The controller logic accepts a customer ID in the path and an item_id in the request body, but does not verify that the referenced item belongs to the customer ID from the URL. In addition, the routes are not properly covered by ACL mapping. A low-privileged admin can therefore mix an unrelated path customer ID with a victim customer's item_id and delete data across accounts.
The impact is unauthorized destructive modification of customer-owned data. Depending on the endpoint, an attacker can remove saved wishlist entries, compare-list entries, or active cart items belonging to unrelated customers. This can interfere with customer preferences, shopping intent, active purchases, and behavior analytics. The issue combines vertical privilege escalation with missing object ownership validation.
The vendor was contacted beforehand and confirmed the report. No CVE is included in the public report at the time of preparation. |
|---|
| स्रोत | ⚠️ https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/07_09_english_vulnerability_report.md |
|---|
| उपयोगकर्ता | Mitchell_45 (UID 98150) |
|---|
| सबमिशन | 26/06/2026 06:39 AM (2 महीनों पहले) |
|---|
| संयम | 14/08/2026 09:44 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 389973 [Webkul Bagisto तक 2.4.4 Customer Item Deletion Endpoint अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|