The vulnerability in Webkul Bagisto 2.4.9 arises from the user-update endpoint (admin.settings.users.update, UserController::update()) not properly verifying whether the actor is authorized to assign the requested role. It also fails to prevent users from changing their own roles and does not restrict role assignment to roles with permission sets that are subsets of the actor's permissions. Consequently, a low-privileged backend user with the settings.users.edit permission can escalate to full administrator privileges by setting their own role_id to Administrator.

An authenticated backend user with limited permissions can escalate to full administrator privileges. This grants them unrestricted access to all admin-panel capabilities, including sensitive store configuration settings, payment gateway credentials, and customer personal data. This could lead to unauthorized data access, manipulation, and potential compromise of the entire e-commerce platform.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the settings.users.edit permission to trusted users only and monitor for suspicious role changes. Avoid granting this permission broadly to reduce risk.