| Título | Webkul Bagisto <=2.4.4 Information Disclosure |
|---|
| Descrição | Bagisto 2.4.4 contains multiple broken access control vulnerabilities in backend customer behavior-data endpoints. A low-privileged backend user without Customers permissions can directly query customer-specific JSON endpoints and read behavior data for arbitrary customer IDs.
The affected endpoints include GET /admin/customers/{id}/wishlist-items, GET /admin/customers/{id}/compare-items, GET /admin/customers/{id}/cart/items, and GET /admin/customers/{id}/recent-order-items. A user with only minimal admin access is blocked from the normal Customers page, but direct requests to these endpoints return JSON data rather than an authorization error. The issue exists because these routes are not properly covered by ACL mapping, and the corresponding controller actions query customer-related repositories by the supplied ID without an explicit authorization check.
The impact is unauthorized disclosure of customer behavior data. Depending on the target account, exposed data can include wishlist entries, compare-list entries, active cart contents, and recently ordered products. These data sets reveal product interests, purchasing intent, and recent purchasing activity. The issue allows vertical privilege escalation from a low-privileged backend account to customer-data visibility that should require customer-management privileges.
The vendor was contacted beforehand and confirmed the report. No CVE is included in the public report at the time of preparation.
|
|---|
| Fonte | ⚠️ https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/03_06_english_vulnerability_report.md |
|---|
| Utilizador | Mitchell45 (UID 98149) |
|---|
| Submissão | 26/06/2026 06h47 (há 2 meses) |
|---|
| Moderação | 16/08/2026 20h05 (2 months later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 391197 [Webkul Bagisto até 2.4.4 Backend Customer Behavior Data Endpoint /admin/customers ID Elevação de Privilégios] |
|---|
| Pontos | 20 |
|---|