Threats affecting pkg:github/webkul/bagisto

An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and the downloadable fulfilment components.

CVE-2026-79411 is a privilege escalation vulnerability in Webkul Bagisto version 2.4.9. An authenticated backend user with only the settings.users.edit permission can escalate to full administrator privileges by exploiting improper role assignment validation in the user-update endpoint. This allows the attacker to gain full admin-panel capabilities, including access to store configuration, payment credentials, and customer personal information.

Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce their order total below the legitimate price of shippable goods.

A security vulnerability (CVE-2026-19838) exists in Webkul Bagisto versions prior to 2.4.5 affecting the backend reporting endpoint at /admin/reporting/sales/. This vulnerability allows an attacker with some privileges to bypass authorization controls remotely. The vendor has acknowledged the issue and is addressing it through their internal security processes, with some fixes already implemented and others planned for upcoming releases. The vulnerability has a low severity score and no known exploits are currently active in the wild.

A vulnerability in Webkul Bagisto up to version 2.4.4 affects the Customer Item Deletion Endpoint, leading to improper access controls. The issue can be exploited remotely and the exploit code is publicly available. The vendor has acknowledged the issue, stating it was identified internally prior to public disclosure and is being addressed through their security and development lifecycle, with some fixes already implemented and others planned for upcoming releases. The vulnerability has a low severity rating.