| tiêu đề | Webkul Bagisto 2.4.6 Missing Authorization |
|---|
| Mô tả | A missing server-side ACL authorization check was identified in Bagisto 2.4.6 in the invoice mass status update endpoint:
POST /admin/sales/invoices/mass-update/state
An authenticated restricted administrative user with dashboard-only permissions and without Sales or Invoices permissions can directly invoke this endpoint and modify invoice payment states, including changing an invoice from pending to paid.
The same restricted user is denied access to the corresponding Sales / Invoices interface with HTTP 401 Unauthorized. However, a direct request to the backend endpoint succeeds and returns HTTP 200 because the route is not consistently protected by the configured Bagisto ACL authorization mechanism.
This allows a low-privileged administrative account to perform an operation outside its assigned role permissions and affects the integrity of invoice and payment-state information.
The vendor acknowledged that the endpoint was not correctly mapped in the ACL configuration, confirmed that it should have been protected consistently with the corresponding user-interface permissions, and stated that the issue was corrected by its engineering team. However, the vendor disputes the security classification and considers the issue a permission-enforcement product bug. The vendor did not provide a fixing commit, pull request, affected version range, fixed version, security advisory, or researcher acknowledgement.
Vulnerability type: Missing Authorization / Incorrect Authorization
CWE: CWE-862
Alternative CWE: CWE-863
Authentication required: Authenticated restricted administrative account
Privileges required: Low
User interaction: None
Impact: Unauthorized modification of invoice payment states and loss of financial workflow integrity
Suggested CVSS 3.1 vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Suggested CVSS 3.1 score:
6.5 Medium
CVE assignment is requested for this independently verifiable server-side authorization bypass. |
|---|
| Nguồn | ⚠️ https://drive.google.com/file/d/1ymuUIZJaHZ7oDyebyLKn9RfRPAzDKMmm/view |
|---|
| Người dùng | ciphersecuritylabs (UID 99852) |
|---|
| Đệ trình | 17/07/2026 23:03 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 28/09/2026 09:42 (2 months later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 410992 [Webkul Bagisto đến 2.4.6 Invoice Mass Status Update state nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|