| タイトル | Webkul Bagisto <=2.4.4 Authorization Bypass |
|---|
| 説明 | Bagisto 2.4.4 contains a broken access control vulnerability in the backend customer detail feature. A low-privileged backend user without Customers permissions can directly access arbitrary customer profile pages and related customer data by requesting a customer ID.
The affected endpoint is GET /admin/customers/view/{id}. The related AJAX views exposed through the type query parameter, including orders, invoices, and reviews, are also affected. Although the low-privileged user is blocked from opening the normal customer list page, direct requests to the customer detail route succeed. The issue exists because the route is not properly covered by ACL mapping and the controller action directly loads and returns customer data without an additional explicit authorization check.
The impact is unauthorized access to customer profile data and related business records. Depending on the target account, exposed data may include name, email address, phone number, gender, date of birth, customer group, addresses, orders, invoices, and reviews. This breaks the intended role boundary inside the admin panel and allows vertical privilege escalation and sensitive data exposure.
The vendor was contacted beforehand and confirmed the report. No CVE is included in the public report at the time of preparation.
|
|---|
| ソース | ⚠️ https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/02_english_vulnerability_report.md |
|---|
| ユーザー | Mitchell45 (UID 98149) |
|---|
| 送信 | 2026年06月26日 06:40 (2 月 ago) |
|---|
| モデレーション | 2026年08月14日 09:44 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 389974 [Webkul Bagisto 迄 2.4.4 Backend Customer Detail Feature /admin/customers/view 識別子 特権昇格] |
|---|
| ポイント | 20 |
|---|