| 제목 | Webkul Bagisto <=2.4.4 Authorization Bypass |
|---|
| 설명 | Bagisto 2.4.4 contains a broken access control vulnerability in the backend customer detail feature. A low-privileged backend user without Customers permissions can directly access arbitrary customer profile pages and related customer data by requesting a customer ID.
The affected endpoint is GET /admin/customers/view/{id}. The related AJAX views exposed through the type query parameter, including orders, invoices, and reviews, are also affected. Although the low-privileged user is blocked from opening the normal customer list page, direct requests to the customer detail route succeed. The issue exists because the route is not properly covered by ACL mapping and the controller action directly loads and returns customer data without an additional explicit authorization check.
The impact is unauthorized access to customer profile data and related business records. Depending on the target account, exposed data may include name, email address, phone number, gender, date of birth, customer group, addresses, orders, invoices, and reviews. This breaks the intended role boundary inside the admin panel and allows vertical privilege escalation and sensitive data exposure.
The vendor was contacted beforehand and confirmed the report. No CVE is included in the public report at the time of preparation.
|
|---|
| 원천 | ⚠️ https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/02_english_vulnerability_report.md |
|---|
| 사용자 | Mitchell45 (UID 98149) |
|---|
| 제출 | 2026. 06. 26. AM 06:40 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 14. AM 09:44 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 389974 [Webkul Bagisto 까지 2.4.4 Backend Customer Detail Feature /admin/customers/view 아이디 권한 상승] |
|---|
| 포인트들 | 20 |
|---|