CVE-2026-21446

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21446", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-12-29T03:00:29.277Z", "datePublished": "2026-01-02T19:18:36.095Z", "dateUpdated": "2026-01-05T15:54:55.916Z"}, "containers": {"cna": {"title": "Bagisto Missing Authentication on Installer API Endpoints", "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "lang": "en", "description": "CWE-306: Missing Authentication for Critical Function", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P", "version": "4.0"}}], "references": [{"name": "https://github.com/bagisto/bagisto/security/advisories/GHSA-6h7w-v2xr-mqvw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/bagisto/bagisto/security/advisories/GHSA-6h7w-v2xr-mqvw"}, {"name": "https://github.com/bagisto/bagisto/commit/380c045e48490da740cd505fb192cc45e1809bed", "tags": ["x_refsource_MISC"], "url": "https://github.com/bagisto/bagisto/commit/380c045e48490da740cd505fb192cc45e1809bed"}], "affected": [{"vendor": "bagisto", "product": "bagisto", "versions": [{"version": ">= 2.3.0, < 2.3.10", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-02T19:18:36.095Z"}, "descriptions": [{"lang": "en", "value": "Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation is complete. The underlying API endpoints (`/install/api/*`) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly. This allows any unauthenticated attacker to create admin accounts, modify application configurations, and potentially overwrite existing data. Version 2.3.10 fixes the issue."}], "source": {"advisory": "GHSA-6h7w-v2xr-mqvw", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-05T15:54:26.979889Z", "id": "CVE-2026-21446", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-05T15:54:55.916Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21446", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-05T15:54:26.979889Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-05T15:54:52.277Z"}}], "cna": {"title": "Bagisto Missing Authentication on Installer API Endpoints", "source": {"advisory": "GHSA-6h7w-v2xr-mqvw", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "bagisto", "product": "bagisto", "versions": [{"status": "affected", "version": ">= 2.3.0, < 2.3.10"}]}], "references": [{"url": "https://github.com/bagisto/bagisto/security/advisories/GHSA-6h7w-v2xr-mqvw", "name": "https://github.com/bagisto/bagisto/security/advisories/GHSA-6h7w-v2xr-mqvw", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/bagisto/bagisto/commit/380c045e48490da740cd505fb192cc45e1809bed", "name": "https://github.com/bagisto/bagisto/commit/380c045e48490da740cd505fb192cc45e1809bed", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation is complete. The underlying API endpoints (`/install/api/*`) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly. This allows any unauthenticated attacker to create admin accounts, modify application configurations, and potentially overwrite existing data. Version 2.3.10 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-02T19:18:36.095Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21446", "state": "PUBLISHED", "dateUpdated": "2026-01-05T15:54:55.916Z", "dateReserved": "2025-12-29T03:00:29.277Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-02T19:18:36.095Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "bagisto", "vendor": "bagisto", "versions": [{"status": "affected", "version": ">= 2.3.0, < 2.3.10"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:webkul:bagisto:*:*:*:*:*:*:*:*", "matchCriteriaId": "284410C8-A6CA-4BA3-A484-8E4B8EE3DC4E", "versionEndExcluding": "2.3.10", "versionStartIncluding": "2.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation is complete. The underlying API endpoints (`/install/api/*`) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly. This allows any unauthenticated attacker to create admin accounts, modify application configurations, and potentially overwrite existing data. Version 2.3.10 fixes the issue."}, {"lang": "es", "value": "Bagisto es una plataforma de comercio electr\u00f3nico laravel de c\u00f3digo abierto. En versiones de la rama 2.3 anteriores a la 2.3.10, las rutas de la API permanecen activas incluso despu\u00e9s de que la instalaci\u00f3n inicial se haya completado. Los endpoints de la API subyacentes ('/install/api/*') son directamente accesibles y explotables sin ninguna autenticaci\u00f3n. Un atacante puede omitir el instalador de Ib por completo llamando directamente a los endpoints de la API. Esto permite a cualquier atacante no autenticado crear cuentas de administrador, modificar configuraciones de la aplicaci\u00f3n y potencialmente sobrescribir datos existentes. La versi\u00f3n 2.3.10 corrige el problema."}], "id": "CVE-2026-21446", "lastModified": "2026-06-17T10:18:41.217", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21446", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-05T15:54:26.979889Z", "version": "2.0.3"}}]}, "published": "2026-01-02T20:16:18.020", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/bagisto/bagisto/commit/380c045e48490da740cd505fb192cc45e1809bed"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/bagisto/bagisto/security/advisories/GHSA-6h7w-v2xr-mqvw"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T19:23:03.682832+00:00", "value": {"mitigation_remediation": ["Upgrade Bagisto to version 2.3.10 or newer, which removes the unauthenticated installer API endpoints.", "If an immediate upgrade is not possible, disable or remove the /install/api/* routes from the application\u2019s routing configuration or block them at the web server level.", "Restrict access to the installer API endpoints by applying network-level controls, such as limiting connections to localhost, VPN, or specific IP ranges."], "summary": {"action": "Patch immediately", "impact": "Unauthenticated privilege escalation via exposed installer API endpoints"}, "threat_synthesis": {"affected_systems": "The vulnerable product is the Bagisto eCommerce platform from Webkul. Any deployment running version 2.3 on the 2.3 branch earlier than 2.3.10 is affected; version 2.3.10 and later contain the fix.", "description_and_impact": "Bagisto\u2019s installer API routes remain accessible after the initial setup on versions prior to 2.3.10. The lack of authentication allows an attacker to create administrative accounts, alter configuration settings, and overwrite existing data, effectively granting full control over the e\u2011commerce site.", "risk_and_exploitability": "The flaw is scored CVSS 8.8 indicating high severity, but the EPSS score is below 1% and it is not listed in KEV, suggesting low current exploitation likelihood. Nevertheless, the absence of authentication means that any unauthenticated user who can reach the web application can exploit the /install/api/* routes. Successful exploitation results in full administrative access and the ability to modify or delete application data, posing a severe threat to confidentiality, integrity, and availability."}}}}, "created": "2026-01-05T10:13:42.586100+00:00", "updated": "2026-04-18T19:30:08.964525+00:00", "vendors": ["webkul", "webkul$PRODUCT$bagisto"]}