| 제목 | Webkul Bagisto <=2.4.4 Information Disclosure |
|---|
| 설명 | Bagisto 2.4.4 contains multiple broken access control vulnerabilities in backend customer behavior-data endpoints. A low-privileged backend user without Customers permissions can directly query customer-specific JSON endpoints and read behavior data for arbitrary customer IDs.
The affected endpoints include GET /admin/customers/{id}/wishlist-items, GET /admin/customers/{id}/compare-items, GET /admin/customers/{id}/cart/items, and GET /admin/customers/{id}/recent-order-items. A user with only minimal admin access is blocked from the normal Customers page, but direct requests to these endpoints return JSON data rather than an authorization error. The issue exists because these routes are not properly covered by ACL mapping, and the corresponding controller actions query customer-related repositories by the supplied ID without an explicit authorization check.
The impact is unauthorized disclosure of customer behavior data. Depending on the target account, exposed data can include wishlist entries, compare-list entries, active cart contents, and recently ordered products. These data sets reveal product interests, purchasing intent, and recent purchasing activity. The issue allows vertical privilege escalation from a low-privileged backend account to customer-data visibility that should require customer-management privileges.
The vendor was contacted beforehand and confirmed the report. No CVE is included in the public report at the time of preparation.
|
|---|
| 원천 | ⚠️ https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/03_06_english_vulnerability_report.md |
|---|
| 사용자 | Mitchell45 (UID 98149) |
|---|
| 제출 | 2026. 06. 26. AM 06:47 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 16. PM 08:05 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 391197 [Webkul Bagisto 까지 2.4.4 Backend Customer Behavior Data Endpoint /admin/customers 아이디 권한 상승] |
|---|
| 포인트들 | 20 |
|---|