CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad

CVE-2026-21447

I'll Have What He's Having: IDOR in Bagisto eCommerce

Alon Barad
Alon Barad
Software Engineer

Jan 2, 2026·5 min read·18 visits

Executive Summary (TL;DR)

Bagisto trusted user input a little too much. By simply changing the Order ID in a reorder request, an attacker could force the application to fetch items from *anyone's* past order and dump them into their own shopping cart. It's the digital equivalent of reaching into someone else's grocery bag at the checkout line.

An Insecure Direct Object Reference (IDOR) in the Bagisto Laravel eCommerce platform allows authenticated users to 'reorder' items from any other customer's order history, effectively leaking purchasing habits and sensitive cart data.

Official Patches

BagistoOfficial fix commit on GitHub

Fix Analysis (1)

Technical Appendix

CVSS Score
7.1/ 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Affected Systems

Bagisto eCommerce Platform

Affected Versions Detail

Product
Affected Versions
Fixed Version
Bagisto
Bagisto
< 2.3.102.3.10
AttributeDetail
CWECWE-639 (Authorization Bypass Through User-Controlled Key)
CVSS v3.17.1 (High)
Attack VectorNetwork (Authenticated)
ImpactConfidentiality Loss (High)
Exploit StatusTrivial / PoC Available
Patch Date2025-12-23

MITRE ATT&CK Mapping

T1596Search Open Technical Databases
Reconnaissance
T1078Valid Accounts
Initial Access
T1213Data from Information Repositories
Collection
CWE-639
Insecure Direct Object Reference (IDOR)

The application does not verify that the user ID associated with the requested object matches the currently authenticated user, allowing access to unauthorized records.

Known Exploits & Detection

Manual AnalysisExploitation is trivial via manual manipulation of the URL ID parameter.

Vulnerability Timeline

Vendor releases patch (Commit b2b1cf62)
2025-12-23
CVE-2026-21447 assigned and published
2026-01-02
GHSA-x5rw-qvvp-5cgm advisory published
2026-01-02

References & Sources

  • [1]GitHub Security Advisory
  • [2]NVD Detail

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•about 1 hour ago•CVE-2026-54068
5.9

CVE-2026-54068: Unauthenticated Server-Side Template Injection and SQLite Exfiltration in SiYuan PKM

An authentication bypass in the SiYuan personal knowledge management system before version 3.7.0 exposes a dynamic icon rendering endpoint. This endpoint processes client-supplied Go template directives. By submitting a crafted request, an unauthenticated remote attacker can leverage registered database template functions to execute arbitrary read-only SQL queries and exfiltrate workspace contents.

Amit Schendel
Amit Schendel
3 views•5 min read
•about 2 hours ago•CVE-2026-54069
9.1

CVE-2026-54069: Authentication Bypass in SiYuan Note via Origin Header Spoofing

CVE-2026-54069 is a critical authentication bypass vulnerability in the SiYuan Note personal knowledge management system. The flaw is located in the HTTP server's middleware handling API authorization, which unconditionally trusts requests carrying a 'chrome-extension://' scheme in the Origin HTTP header, granting administrative access without validating API tokens.

Alon Barad
Alon Barad
2 views•5 min read
•about 2 hours ago•CVE-2026-54089
9.1

CVE-2026-54089: Authentication Bypass by Spoofing in File Browser

CVE-2026-54089 is a critical authentication bypass vulnerability in File Browser affecting instances configured with proxy-based authentication. An unauthenticated remote attacker with direct network access can impersonate arbitrary users or register new accounts by spoofing configured HTTP headers.

Amit Schendel
Amit Schendel
3 views•7 min read
•about 3 hours ago•GHSA-99J7-FHR2-XFJ4
10.0

GHSA-99J7-FHR2-XFJ4: Malicious Remote Code Execution Payload in 'exploration' Cargo Crate

The malicious Cargo package 'exploration' was uploaded to the crates.io registry. During compilation or package import, the crate executes code designed to establish an outbound TCP/HTTP connection, download an external second-stage binary, and execute the binary locally on the host machine. This creates an unauthenticated remote code execution vector impacting developer environments and continuous integration pipelines.

Amit Schendel
Amit Schendel
6 views•6 min read
•about 3 hours ago•CVE-2026-54088
9.3

CVE-2026-54088: Pre-Authentication Remote Code Execution in File Browser Hook Authentication

CVE-2026-54088 is a critical command injection vulnerability in File Browser prior to version 2.63.6. When Hook Authentication is enabled, the application interpolates unsanitized credentials into a shell command, allowing unauthenticated remote code execution.

Alon Barad
Alon Barad
4 views•6 min read
•about 4 hours ago•GHSA-QV4M-M73M-8HJ7
8.8

GHSA-qv4m-m73m-8hj7: Authenticated Arbitrary File Upload leading to Remote Code Execution in NotrinosERP

An authenticated remote code execution vulnerability exists in NotrinosERP (versions up to and including 1.0.0) within the Human Resource Management (HRM) module. Users with employee management permissions can upload arbitrary file types, including PHP scripts, which are written directly to a web-accessible directory. This allows for arbitrary code execution in the context of the web-server user.

Alon Barad
Alon Barad
4 views•6 min read