PT-2026-1127

CVE-2026-21447

Published

2026-01-02

Updated

2026-01-04

Description by

CVSS 3.1

7.1

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Bagisto versions prior to 2.3.10

Description An Insecure Direct Object Reference issue exists in the customer order reorder function. This allows authenticated customers to add items from another customer's order to their own shopping cart by manipulating the order ID parameter. This can expose sensitive purchase information and potentially enable fraud.

Recommendations Update to version 2.3.10 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Denizparlak

Vendors

Affected products

Weakness enumeration

CWE-284: Improper Access Control

CWE-639: Authorization Bypass Through User-Controlled Key