CVE-2026-21447

Published: Jan 2, 2026Modified: Jun 17, 2026

7.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Exploitability: 2.8 / Impact: 4.2

Source: security-advisories@github.com (Secondary)

Description

Bagisto is an open source laravel eCommerce platform. Prior to version 2.3.10, an Insecure Direct Object Reference vulnerability in the customer order reorder function allows any authenticated customer to add items from another customer's order to their own shopping cart by manipulating the order ID parameter. This exposes sensitive purchase information and enables potential fraud. Version 2.3.10 patches the issue.

Affected (1)

Products: Webkul: Bagisto

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Webkul Bagisto	Before 2.3.10

Related CWEs

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (2)

https://github.com/bagisto/bagisto/commit/b2b1cf62577245d03a68532478cffbe321df74d3

Source: security-advisories@github.com

Patch

https://github.com/bagisto/bagisto/security/advisories/GHSA-x5rw-qvvp-5cgm

Source: security-advisories@github.com

ExploitVendor Advisory

Timeline

No history available yet.