| タイトル | Webkul Bagisto <=2.4.4 Information Disclosure |
|---|
| 説明 | Bagisto 2.4.4 contains a broken access control vulnerability in the backend customer search endpoint. A low-privileged backend user without Customers permissions can directly query the customer search API and enumerate customer records.
The affected endpoint is GET /admin/customers/search?query=... . A user with only minimal admin access is blocked from opening the normal customer-management page, but direct requests to this search endpoint return JSON customer records. Queries can use partial names, partial email addresses, or broad patterns such as @ to enumerate customers. The issue exists because the route is not properly covered by ACL mapping and the controller returns raw customer model data without an additional authorization check or response minimization.
The impact is unauthorized customer information disclosure and bulk enumeration. Exposed fields may include customer ID, first name, last name, email address, status, customer group ID, channel ID, verification state, and token. The token field is especially sensitive because it is related to the customer account verification workflow. This allows a low-privileged admin user to build customer lists and retrieve internal account data that should require customer-management privileges.
The vendor was contacted beforehand and confirmed the report. No CVE is included in the public report at the time of preparation. |
|---|
| ソース | ⚠️ https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/10_english_vulnerability_report.md |
|---|
| ユーザー | Mitchell_45 (UID 98150) |
|---|
| 送信 | 2026年06月26日 06:41 (2 月 ago) |
|---|
| モデレーション | 2026年08月14日 09:44 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 389975 [Webkul Bagisto 迄 2.4.4 Customer Search /admin/customers/search クエリ 情報漏えい] |
|---|
| ポイント | 20 |
|---|