| शीर्षक | Webkul Bagisto <=2.4.4 Authorization Bypass |
|---|
| विवरण | Bagisto 2.4.4 contains a broken access control vulnerability in the backend customer detail feature. A low-privileged backend user without Customers permissions can directly access arbitrary customer profile pages and related customer data by requesting a customer ID.
The affected endpoint is GET /admin/customers/view/{id}. The related AJAX views exposed through the type query parameter, including orders, invoices, and reviews, are also affected. Although the low-privileged user is blocked from opening the normal customer list page, direct requests to the customer detail route succeed. The issue exists because the route is not properly covered by ACL mapping and the controller action directly loads and returns customer data without an additional explicit authorization check.
The impact is unauthorized access to customer profile data and related business records. Depending on the target account, exposed data may include name, email address, phone number, gender, date of birth, customer group, addresses, orders, invoices, and reviews. This breaks the intended role boundary inside the admin panel and allows vertical privilege escalation and sensitive data exposure.
The vendor was contacted beforehand and confirmed the report. No CVE is included in the public report at the time of preparation.
|
|---|
| स्रोत | ⚠️ https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/02_english_vulnerability_report.md |
|---|
| उपयोगकर्ता | Mitchell45 (UID 98149) |
|---|
| सबमिशन | 26/06/2026 06:40 AM (2 महीनों पहले) |
|---|
| संयम | 14/08/2026 09:44 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 389974 [Webkul Bagisto तक 2.4.4 Backend Customer Detail Feature /admin/customers/view पहचान अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|