| タイトル | Webkul Bagisto <=2.4.4 Authorization Bypass |
|---|
| 説明 | Bagisto 2.4.4 contains a broken access control vulnerability in the admin customer impersonation feature. A low-privileged backend user that can log in to the admin panel, but does not have Customers permissions, can directly request the customer impersonation endpoint and switch the frontend customer session to an arbitrary customer account.
The affected endpoint is GET /admin/customers/login-as-customer/{id}. In normal operation, impersonating a customer should be limited to administrators with customer-management privileges. However, the route is not properly covered by ACL mapping, and the controller action logs in the target customer without performing an additional explicit authorization check. As a result, a backend account with only minimal access, such as Dashboard access, can request a known or guessed customer ID and be redirected to the frontend customer account area as that customer.
The impact is unauthorized customer account impersonation and vertical privilege escalation inside the admin panel. An attacker with a low-privileged admin account may access customer profile information, addresses, orders, downloadable items, and other account data. The attacker may also be able to perform frontend actions as the victim customer, depending on the customer's account state and available storefront functionality.
The vendor was contacted beforehand and confirmed the report. No CVE is included in the public report at the time of preparation. |
|---|
| ソース | ⚠️ https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/01_english_vulnerability_report.md |
|---|
| ユーザー | Mitchell45 (UID 98149) |
|---|
| 送信 | 2026年06月26日 06:37 (2 月 ago) |
|---|
| モデレーション | 2026年08月14日 09:44 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 389972 [Webkul Bagisto 迄 2.4.4 Admin Customer Impersonation Feature login-as-customer 識別子 特権昇格] |
|---|
| ポイント | 20 |
|---|