Submeter #870355: Webkul Bagisto <=2.4.4 Authorization Bypass

Bagisto 2.4.4 contains multiple broken access control vulnerabilities in backend configuration-related endpoints. A low-privileged backend user without configuration-management permissions can directly execute maintenance actions, search configuration items, and download configuration-linked files.

Affected endpoints include POST /admin/configuration/cache-management/execute, GET /admin/configuration/search?query=..., and GET /admin/configuration/{slug?}/{slug2?}/{path}. A low-privileged admin is blocked from the normal configuration page, but direct requests to these helper endpoints succeed. The cache-management endpoint accepts an action parameter and maps it to predefined Artisan maintenance commands such as view clearing, cache clearing, route clearing, or config clearing. The search endpoint exposes configuration structure and items, and the download endpoint can return files associated with configuration values when the path is known or discoverable.

The impact is unauthorized operational capability and sensitive configuration exposure. Depending on the action and deployment, an attacker may disrupt application caching, clear operational state, enumerate configuration areas such as mail, payment, shipping, or tax, and download configuration-linked assets. This is a vertical privilege escalation from a minimally privileged backend account into configuration and maintenance functionality.

The vendor was contacted beforehand and confirmed the report. No CVE is included in the public report at the time of preparation.

• Fonte: ⚠️ https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/31_33_english_vulnerability_report.md
• Utilizador: Mitch_45 (UID 99298)
• Submissão: 26/06/2026 06h45 (há 2 meses)
• Moderação: 16/08/2026 20h05 (2 months later)
• Estado: Aceite
• Entrada VulDB: 391195 [Webkul Bagisto até 2.4.4 Configuration Management execute action Elevação de Privilégios]
• Pontos: 20