| Titolo | Webkul Bagisto <=2.4.4 Authorization Bypass |
|---|
| Descrizione | Bagisto 2.4.4 contains multiple broken access control vulnerabilities in backend reporting endpoints. A low-privileged backend user without the corresponding Reporting permissions can directly read and export report data from Sales, Customers, and Products reporting modules.
Affected endpoint groups include /admin/reporting/sales/stats, /admin/reporting/sales/export, /admin/reporting/sales/view, /admin/reporting/sales/view/stats, and equivalent stats, export, view, and view/stats routes for customers and products. A low-privileged admin is blocked from the normal reporting index pages, but direct requests to the related report endpoints return JSON statistics, detail pages, or downloadable report files. The issue exists because ACL appears to protect only the top-level report index routes, while related stats, export, view, and view.stats endpoints are not properly covered.
The impact is unauthorized disclosure and bulk extraction of sensitive business intelligence. Depending on the module and selected report type, exposed data can include sales performance, revenue trends, refunds, payment-method analytics, customer rankings, customer contribution metrics, top customer groups, product sales performance, wishlist activity, review activity, and search-term analytics. The export endpoints also make offline extraction of report data straightforward.
The vendor was contacted beforehand and confirmed the report. No CVE is included in the public report at the time of preparation. |
|---|
| Fonte | ⚠️ https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/19_30_english_vulnerability_report.md |
|---|
| Utente | Mitch_45 (UID 99298) |
|---|
| Sottomissione | 26/06/2026 06:42 (2 mesi fa) |
|---|
| Moderazione | 14/08/2026 09:44 (2 months later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 389976 [Webkul Bagisto fino a 2.4.4 Backend Reporting Endpoint /admin/reporting/sales/ escalationi di privilegi] |
|---|
| Punti | 20 |
|---|