CVE-2026-21446

Katalog CVE

CVSS 9.8 · Critical EPSS 0,63%

Kerentanan Missing Authentication for Critical Function pada webkul bagisto. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation is complete. The underlying API endpoints (`/install/api/*`) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly. This allows any unauthenticated attacker to create admin accounts, modify application configurations, and potentially overwrite existing data. Version 2.3.10 fixes the issue.

Rincian

Terbit di NVD

2 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

0,63% peluang dieksploitasi; lebih tinggi dari 48,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/bagisto/bagisto/security/advisories/GHSA-6h7w-v2xr-mqvw exploit · advisory vendor
• https://github.com/bagisto/bagisto/commit/380c045e48490da740cd505fb192cc45e1809bed patch