| 제목 | Webkul Bagisto <=2.4.4 Information Disclosure |
|---|
| 설명 | Bagisto 2.4.4 contains a broken access control vulnerability in the backend customer search endpoint. A low-privileged backend user without Customers permissions can directly query the customer search API and enumerate customer records.
The affected endpoint is GET /admin/customers/search?query=... . A user with only minimal admin access is blocked from opening the normal customer-management page, but direct requests to this search endpoint return JSON customer records. Queries can use partial names, partial email addresses, or broad patterns such as @ to enumerate customers. The issue exists because the route is not properly covered by ACL mapping and the controller returns raw customer model data without an additional authorization check or response minimization.
The impact is unauthorized customer information disclosure and bulk enumeration. Exposed fields may include customer ID, first name, last name, email address, status, customer group ID, channel ID, verification state, and token. The token field is especially sensitive because it is related to the customer account verification workflow. This allows a low-privileged admin user to build customer lists and retrieve internal account data that should require customer-management privileges.
The vendor was contacted beforehand and confirmed the report. No CVE is included in the public report at the time of preparation. |
|---|
| 원천 | ⚠️ https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/10_english_vulnerability_report.md |
|---|
| 사용자 | Mitchell_45 (UID 98150) |
|---|
| 제출 | 2026. 06. 26. AM 06:41 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 14. AM 09:44 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 389975 [Webkul Bagisto 까지 2.4.4 Customer Search /admin/customers/search 질문 정보 공개] |
|---|
| 포인트들 | 20 |
|---|