CVE-2026-21446

HIGH EPSS 43.5%
Published Jan 2, 20265mo ago · Modified Jun 17, 20261w ago
8.8 CVSS 4.0
High
Find Similar
Published Jan 2, 2026 5mo ago
Last Modified Jun 17, 2026 1w ago

Description

Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation is complete. The underlying API endpoints (`/install/api/*`) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly. This allows any unauthenticated attacker to create admin accounts, modify application configurations, and potentially overwrite existing data. Version 2.3.10 fixes the issue.

CVSS Details

Base Score
8.8
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
43.5% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-306 Missing Authentication for Critical Function Authentication

Affected Products 1

VendorProductVersionRange
webkulbagisto*≥2.3.0  –  <2.3.10

References 2

  • github.com https://github.com/bagisto/bagisto/commit/380c045e48490da740cd505fb192cc45e1809bed
    Patch
  • github.com https://github.com/bagisto/bagisto/security/advisories/GHSA-6h7w-v2xr-mqvw
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/bagisto/bagisto/commit/380c045e48490da740cd505fb192cc45e1809bed
    Patch