The vulnerability exists because the user-update endpoint (admin.settings.users.update, UserController::update()) does not verify whether the actor is authorized to assign the requested role, does not prevent users from changing their own roles, and does not restrict role assignment to roles with permission sets that are subsets of the actor's own permissions. By submitting a crafted request setting their own role_id to Administrator, a low-privileged user can escalate to full administrator privileges.

An attacker with minimal backend permissions (settings.users.edit) can gain full administrative control over the Bagisto store, including access to store configuration, payment gateway credentials, and customer personally identifiable information (PII). This could lead to complete compromise of the e-commerce platform and sensitive data exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the settings.users.edit permission to trusted users only and monitor for suspicious role changes. Avoid granting this permission broadly.