CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad

CVE-2026-21447

I'll Have What He's Having: IDOR in Bagisto eCommerce

Alon Barad
Alon Barad
Software Engineer

Jan 2, 2026·5 min read·32 visits

Executive Summary (TL;DR)

Bagisto trusted user input a little too much. By simply changing the Order ID in a reorder request, an attacker could force the application to fetch items from *anyone's* past order and dump them into their own shopping cart. It's the digital equivalent of reaching into someone else's grocery bag at the checkout line.

An Insecure Direct Object Reference (IDOR) in the Bagisto Laravel eCommerce platform allows authenticated users to 'reorder' items from any other customer's order history, effectively leaking purchasing habits and sensitive cart data.

Official Patches

BagistoOfficial fix commit on GitHub

Fix Analysis (1)

Technical Appendix

CVSS Score
7.1/ 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Affected Systems

Bagisto eCommerce Platform

Affected Versions Detail

Product
Affected Versions
Fixed Version
Bagisto
Bagisto
< 2.3.102.3.10
AttributeDetail
CWECWE-639 (Authorization Bypass Through User-Controlled Key)
CVSS v3.17.1 (High)
Attack VectorNetwork (Authenticated)
ImpactConfidentiality Loss (High)
Exploit StatusTrivial / PoC Available
Patch Date2025-12-23

MITRE ATT&CK Mapping

T1596Search Open Technical Databases
Reconnaissance
T1078Valid Accounts
Initial Access
T1213Data from Information Repositories
Collection
CWE-639
Insecure Direct Object Reference (IDOR)

The application does not verify that the user ID associated with the requested object matches the currently authenticated user, allowing access to unauthorized records.

Known Exploits & Detection

Manual AnalysisExploitation is trivial via manual manipulation of the URL ID parameter.

Vulnerability Timeline

Vendor releases patch (Commit b2b1cf62)
2025-12-23
CVE-2026-21447 assigned and published
2026-01-02
GHSA-x5rw-qvvp-5cgm advisory published
2026-01-02

References & Sources

  • [1]GitHub Security Advisory
  • [2]NVD Detail

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•38 minutes ago•CVE-2026-81876
7.5

CVE-2026-81876: Unauthenticated Denial of Service via Infinite Loop in HAPI FHIR SHCParser

CVE-2026-81876 is a high-severity Denial of Service vulnerability in HAPI FHIR, a complete Java implementation of the HL7 FHIR standard. The vulnerability stems from improper usage of Java's java.util.zip.Inflater class within the Smart Health Card (SHC) parser.

Amit Schendel
Amit Schendel
2 views•6 min read
•about 2 hours ago•CVE-2026-82399
7.5

CVE-2026-82399: Resource Exhaustion Denial of Service in CoreDNS Custom Transports

CVE-2026-82399 is a resource management vulnerability in CoreDNS affecting custom DNS transport pathways. Prior to version 1.14.7, transports including DNS-over-HTTPS (DoH), DNS-over-QUIC (DoQ), and DNS-over-gRPC executed the resource-intensive unpack method of the underlying Go DNS library on raw, untrusted incoming payloads before validating the fixed 12-byte DNS header. An unauthenticated remote attacker can exploit this behavior by using nested DNS name compression pointers to trigger substantial heap allocations, leading to memory exhaustion and server termination.

Amit Schendel
Amit Schendel
3 views•7 min read
•about 3 hours ago•CVE-2026-84997
7.5

CVE-2026-84997: Infinite Loop Denial of Service in ReactPHP HTTP Component

An infinite loop vulnerability in ReactPHP's react/http chunked transfer encoding decoder (v0.6.0 up to 1.11.1) allows unauthenticated remote attackers to trigger a denial of service (DoS) by sending crafted chunked requests or responses, completely freezing the single-threaded event loop and pegging CPU usage to 100%.

Alon Barad
Alon Barad
5 views•8 min read
•about 4 hours ago•CVE-2026-88976
6.1

CVE-2026-88976: HTML Deserialization Cross-Site Scripting in @platejs/core

Plate core HTML deserialization APIs parse supplied HTML strings in the active document. When an application passes untrusted or cross-user HTML to these APIs, certain HTML attributes can trigger browser behavior before the HTML is converted into editor nodes.

Amit Schendel
Amit Schendel
5 views•6 min read
•about 5 hours ago•CVE-2026-85999
5.3

CVE-2026-85999: Regular Expression Denial of Service (ReDoS) in Soup Sieve css_parser.py

A polynomial-time Regular Expression Denial of Service (ReDoS) vulnerability in Soup Sieve versions prior to 2.9 allows remote unauthenticated attackers to cause CPU exhaustion and thread-pool denial of service. The vulnerability resides in the trailing whitespace and comment preprocessing step of the CSS parser. An attacker can trigger quadratic backtracking by submitting a crafted CSS selector string containing a long run of internal spaces or comments terminated by a non-matching token. This blocks the Python Global Interpreter Lock (GIL) and halts worker threads.

Amit Schendel
Amit Schendel
5 views•6 min read
•about 6 hours ago•CVE-2026-86000
5.3

CVE-2026-86000: Polynomial-Time Regular Expression Denial of Service in Soup Sieve Selector Parser

A regular expression denial of service (ReDoS) vulnerability in Soup Sieve prior to version 2.9 allows remote attackers to cause CPU exhaustion and service disruption. The issue lies within the definition of the IDENTIFIER and VALUE selector sub-patterns in the CSS parser component, which uses overlapping adjacent quantified groups. When parsing long, crafted, or unclosed CSS selectors, backtracking-based regular expression engines experience quadratic performance degradation. User-controlled selectors can reach this path through soupsieve.compile(), soupsieve.select(), or BeautifulSoup.select(), while applications using only hard-coded selectors are unaffected.

Amit Schendel
Amit Schendel
6 views•7 min read