| Название | Webkul Bagisto <=2.4.4 Authorization Bypass |
|---|
| Описание | Bagisto 2.4.4 contains a broken access control vulnerability in the admin customer impersonation feature. A low-privileged backend user that can log in to the admin panel, but does not have Customers permissions, can directly request the customer impersonation endpoint and switch the frontend customer session to an arbitrary customer account.
The affected endpoint is GET /admin/customers/login-as-customer/{id}. In normal operation, impersonating a customer should be limited to administrators with customer-management privileges. However, the route is not properly covered by ACL mapping, and the controller action logs in the target customer without performing an additional explicit authorization check. As a result, a backend account with only minimal access, such as Dashboard access, can request a known or guessed customer ID and be redirected to the frontend customer account area as that customer.
The impact is unauthorized customer account impersonation and vertical privilege escalation inside the admin panel. An attacker with a low-privileged admin account may access customer profile information, addresses, orders, downloadable items, and other account data. The attacker may also be able to perform frontend actions as the victim customer, depending on the customer's account state and available storefront functionality.
The vendor was contacted beforehand and confirmed the report. No CVE is included in the public report at the time of preparation. |
|---|
| Источник | ⚠️ https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/01_english_vulnerability_report.md |
|---|
| Пользователь | Mitchell45 (UID 98149) |
|---|
| Представление | 26.06.2026 06:37 (2 месяцы назад) |
|---|
| Модерация | 14.08.2026 09:44 (2 months later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 389972 [Webkul Bagisto до 2.4.4 Admin Customer Impersonation Feature login-as-customer ИД эскалация привилегий] |
|---|
| Баллы | 20 |
|---|