| शीर्षक | Webkul Bagisto <=2.4.4 Information Disclosure |
|---|
| विवरण | Bagisto 2.4.4 contains a broken access control vulnerability in the backend customer search endpoint. A low-privileged backend user without Customers permissions can directly query the customer search API and enumerate customer records.
The affected endpoint is GET /admin/customers/search?query=... . A user with only minimal admin access is blocked from opening the normal customer-management page, but direct requests to this search endpoint return JSON customer records. Queries can use partial names, partial email addresses, or broad patterns such as @ to enumerate customers. The issue exists because the route is not properly covered by ACL mapping and the controller returns raw customer model data without an additional authorization check or response minimization.
The impact is unauthorized customer information disclosure and bulk enumeration. Exposed fields may include customer ID, first name, last name, email address, status, customer group ID, channel ID, verification state, and token. The token field is especially sensitive because it is related to the customer account verification workflow. This allows a low-privileged admin user to build customer lists and retrieve internal account data that should require customer-management privileges.
The vendor was contacted beforehand and confirmed the report. No CVE is included in the public report at the time of preparation. |
|---|
| स्रोत | ⚠️ https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/10_english_vulnerability_report.md |
|---|
| उपयोगकर्ता | Mitchell_45 (UID 98150) |
|---|
| सबमिशन | 26/06/2026 06:41 AM (2 महीनों पहले) |
|---|
| संयम | 14/08/2026 09:44 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 389975 [Webkul Bagisto तक 2.4.4 Customer Search /admin/customers/search प्रश्न सूचना का प्रकटीकरण] |
|---|
| अंक | 20 |
|---|