| Título | Webkul Bagisto <=2.4.4 Authorization Bypass |
|---|
| Descrição | Bagisto 2.4.4 contains a broken access control vulnerability in the backend customer detail feature. A low-privileged backend user without Customers permissions can directly access arbitrary customer profile pages and related customer data by requesting a customer ID.
The affected endpoint is GET /admin/customers/view/{id}. The related AJAX views exposed through the type query parameter, including orders, invoices, and reviews, are also affected. Although the low-privileged user is blocked from opening the normal customer list page, direct requests to the customer detail route succeed. The issue exists because the route is not properly covered by ACL mapping and the controller action directly loads and returns customer data without an additional explicit authorization check.
The impact is unauthorized access to customer profile data and related business records. Depending on the target account, exposed data may include name, email address, phone number, gender, date of birth, customer group, addresses, orders, invoices, and reviews. This breaks the intended role boundary inside the admin panel and allows vertical privilege escalation and sensitive data exposure.
The vendor was contacted beforehand and confirmed the report. No CVE is included in the public report at the time of preparation.
|
|---|
| Fonte | ⚠️ https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/02_english_vulnerability_report.md |
|---|
| Utilizador | Mitchell45 (UID 98149) |
|---|
| Submissão | 26/06/2026 06h40 (há 2 meses) |
|---|
| Moderação | 14/08/2026 09h44 (2 months later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 389974 [Webkul Bagisto até 2.4.4 Backend Customer Detail Feature /admin/customers/view ID Elevação de Privilégios] |
|---|
| Pontos | 20 |
|---|