HIGH🇵🇱 Wersja polska

CVE-2026-21447

CVSS 7.1v3.1pub. 2026-01-02upd. 2026-01-08

Bagisto is an open source laravel eCommerce platform. Prior to version 2.3.10, an Insecure Direct Object Reference vulnerability in the customer order reorder function allows any authenticated customer to add items from another customer's order to their own shopping cart by manipulating the order ID parameter. This exposes sensitive purchase information and enables potential fraud. Version 2.3.10 patches the issue.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

  • Webkul Bagisto

    APP
    Webkul
    < 2.3.10
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
IDOR
CWE
References

Related vulnerabilities

CVE-2026-21450HIGH7.3ten sam produkt

Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side t...

CVE-2026-21446HIGH8.8ten sam produkt

Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API route...

CVE-2026-21448HIGH8.9ten sam produkt

Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side t...

CVE-2026-21449HIGH7.4ten sam produkt

Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side t...

CVE-2025-62417HIGH7.1ten sam produkt

Bagisto is an open source laravel eCommerce platform. When product data that begins with a spreadsheet formula...