PT-2026-102327 · Webkul · Bagisto
CVSS v2.0
3.3
Low
| Vector | AV:N/AC:L/Au:M/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Webkul Bagisto versions prior to 2.4.7
Description
An authorization bypass exists in the Invoice Mass Status Update component. A remote attacker can manipulate the endpoint '/admin/sales/invoices/mass-update/state' to perform actions without proper authorization.
Recommendations
Update Webkul Bagisto to version 2.4.7 or later.
Restrict access to the '/admin/sales/invoices/mass-update/state' endpoint as a temporary mitigation measure.
Exploit
Fix
Missing Authorization
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Bagisto