This vulnerability affects Webkul Bagisto versions 2.4.0 through 2.4.4 in the backend customer behavior data endpoint located at /admin/customers. Improper handling of the ID argument leads to improper privilege management, which could allow an attacker with network access to remotely manipulate privileges. The vendor has internally identified and partially addressed the issue prior to public disclosure and plans further remediation in upcoming releases. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited impact on confidentiality, integrity, and availability.

The vulnerability could allow remote attackers to manipulate privilege levels improperly via the backend customer behavior data endpoint, potentially leading to unauthorized access or actions within the affected system. However, the impact is limited as the CVSS score indicates low confidentiality, integrity, and availability impact. There is no evidence of active exploitation in the wild at this time.

The vendor confirms that some fixes have already been applied internally and that remaining issues are planned to be resolved in future product releases. No official patch or remediation level has been publicly released yet. Users should monitor vendor advisories for updates and apply official patches once available. Until then, no specific mitigation steps are provided by the vendor.