| शीर्षक | Webkul Bagisto <=2.4.4 Information Disclosure |
|---|
| विवरण | Bagisto 2.4.4 contains multiple broken access control vulnerabilities in backend customer behavior-data endpoints. A low-privileged backend user without Customers permissions can directly query customer-specific JSON endpoints and read behavior data for arbitrary customer IDs.
The affected endpoints include GET /admin/customers/{id}/wishlist-items, GET /admin/customers/{id}/compare-items, GET /admin/customers/{id}/cart/items, and GET /admin/customers/{id}/recent-order-items. A user with only minimal admin access is blocked from the normal Customers page, but direct requests to these endpoints return JSON data rather than an authorization error. The issue exists because these routes are not properly covered by ACL mapping, and the corresponding controller actions query customer-related repositories by the supplied ID without an explicit authorization check.
The impact is unauthorized disclosure of customer behavior data. Depending on the target account, exposed data can include wishlist entries, compare-list entries, active cart contents, and recently ordered products. These data sets reveal product interests, purchasing intent, and recent purchasing activity. The issue allows vertical privilege escalation from a low-privileged backend account to customer-data visibility that should require customer-management privileges.
The vendor was contacted beforehand and confirmed the report. No CVE is included in the public report at the time of preparation.
|
|---|
| स्रोत | ⚠️ https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/03_06_english_vulnerability_report.md |
|---|
| उपयोगकर्ता | Mitchell45 (UID 98149) |
|---|
| सबमिशन | 26/06/2026 06:47 AM (2 महीनों पहले) |
|---|
| संयम | 16/08/2026 08:05 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 391197 [Webkul Bagisto तक 2.4.4 Backend Customer Behavior Data Endpoint /admin/customers पहचान अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|