This vulnerability in Webkul Bagisto up to version 2.4.4 involves improper authorization checks in the Configuration Management component, specifically in the /admin/configuration/cache-management/execute endpoint. By manipulating the 'action' parameter, an attacker can bypass authorization controls remotely. The vendor has confirmed prior internal identification and partial remediation, with remaining fixes scheduled for upcoming releases. The CVSS 3.1 base score is 5.3, indicating a medium severity issue.

Successful exploitation allows an attacker with network access to bypass authorization controls in the affected component, potentially enabling unauthorized actions within the cache management configuration. The impact is limited by the requirement of at least low privileges (PR:L) and results in partial confidentiality, integrity, and availability impacts as per the CVSS vector.

The vendor has indicated that the issue is being addressed through their internal security and development lifecycle, with some fixes already implemented and others planned for future releases. No explicit patch or workaround is currently provided. Users should monitor vendor communications for official updates and apply patches when available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.