CVE-2026-21447

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21447", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-12-29T03:00:29.277Z", "datePublished": "2026-01-02T20:15:11.750Z", "dateUpdated": "2026-01-02T21:30:38.620Z"}, "containers": {"cna": {"title": "Bagisto has IDOR in Customer Order Reorder Functionality", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/bagisto/bagisto/security/advisories/GHSA-x5rw-qvvp-5cgm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/bagisto/bagisto/security/advisories/GHSA-x5rw-qvvp-5cgm"}, {"name": "https://github.com/bagisto/bagisto/commit/b2b1cf62577245d03a68532478cffbe321df74d3", "tags": ["x_refsource_MISC"], "url": "https://github.com/bagisto/bagisto/commit/b2b1cf62577245d03a68532478cffbe321df74d3"}], "affected": [{"vendor": "bagisto", "product": "bagisto", "versions": [{"version": "< 2.3.10", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-02T20:15:11.750Z"}, "descriptions": [{"lang": "en", "value": "Bagisto is an open source laravel eCommerce platform. Prior to version 2.3.10, an Insecure Direct Object Reference vulnerability in the customer order reorder function allows any authenticated customer to add items from another customer's order to their own shopping cart by manipulating the order ID parameter. This exposes sensitive purchase information and enables potential fraud. Version 2.3.10 patches the issue."}], "source": {"advisory": "GHSA-x5rw-qvvp-5cgm", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-02T21:30:27.531357Z", "id": "CVE-2026-21447", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-02T21:30:38.620Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21447", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-02T21:30:27.531357Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-02T21:30:32.295Z"}}], "cna": {"title": "Bagisto has IDOR in Customer Order Reorder Functionality", "source": {"advisory": "GHSA-x5rw-qvvp-5cgm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "bagisto", "product": "bagisto", "versions": [{"status": "affected", "version": "< 2.3.10"}]}], "references": [{"url": "https://github.com/bagisto/bagisto/security/advisories/GHSA-x5rw-qvvp-5cgm", "name": "https://github.com/bagisto/bagisto/security/advisories/GHSA-x5rw-qvvp-5cgm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/bagisto/bagisto/commit/b2b1cf62577245d03a68532478cffbe321df74d3", "name": "https://github.com/bagisto/bagisto/commit/b2b1cf62577245d03a68532478cffbe321df74d3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Bagisto is an open source laravel eCommerce platform. Prior to version 2.3.10, an Insecure Direct Object Reference vulnerability in the customer order reorder function allows any authenticated customer to add items from another customer's order to their own shopping cart by manipulating the order ID parameter. This exposes sensitive purchase information and enables potential fraud. Version 2.3.10 patches the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-02T20:15:11.750Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21447", "state": "PUBLISHED", "dateUpdated": "2026-01-02T21:30:38.620Z", "dateReserved": "2025-12-29T03:00:29.277Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-02T20:15:11.750Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "bagisto", "vendor": "bagisto", "versions": [{"status": "affected", "version": "< 2.3.10"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:webkul:bagisto:*:*:*:*:*:*:*:*", "matchCriteriaId": "E9A19FD0-5100-48D6-BBB3-5A4CA1D90593", "versionEndExcluding": "2.3.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Bagisto is an open source laravel eCommerce platform. Prior to version 2.3.10, an Insecure Direct Object Reference vulnerability in the customer order reorder function allows any authenticated customer to add items from another customer's order to their own shopping cart by manipulating the order ID parameter. This exposes sensitive purchase information and enables potential fraud. Version 2.3.10 patches the issue."}, {"lang": "es", "value": "Bagisto es una plataforma de eCommerce laravel de c\u00f3digo abierto. Antes de la versi\u00f3n 2.3.10, una vulnerabilidad de Referencia Directa a Objeto Insegura en la funci\u00f3n de reordenar pedidos del cliente permite a cualquier cliente autenticado a\u00f1adir art\u00edculos del pedido de otro cliente a su propio carrito de compras manipulando el par\u00e1metro de ID de pedido. Esto expone informaci\u00f3n de compra sensible y posibilita un fraude potencial. La versi\u00f3n 2.3.10 corrige el problema."}], "id": "CVE-2026-21447", "lastModified": "2026-06-17T10:18:41.333", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21447", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-02T21:30:27.531357Z", "version": "2.0.3"}}]}, "published": "2026-01-02T21:15:58.773", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/bagisto/bagisto/commit/b2b1cf62577245d03a68532478cffbe321df74d3"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/bagisto/bagisto/security/advisories/GHSA-x5rw-qvvp-5cgm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T19:22:45.003908+00:00", "value": {"mitigation_remediation": ["Upgrade Bagisto to 2.3.10 or later, which removes the IDOR flaw.", "Implement server\u2011side validation to confirm that the order ID supplied is owned by the authenticated customer before processing a reorder request; reject any mismatched attempts.", "Disable or limit the reorder functionality for guest users until a reliable ownership check is in place."], "summary": {"action": "Patching", "impact": "Unauthorized Order Reuse and Sensitive Purchase Data Exposure"}, "threat_synthesis": {"affected_systems": "All Bagisto installations running a version earlier than 2.3.10 are vulnerable. The affected product is Bagisto, as identified by its CNA vendor/product designation. Versions 2.3.10 and later include the patch that closes the issue.", "description_and_impact": "Bagisto, an open\u2011source Laravel eCommerce platform, contains an Insecure Direct Object Reference in the customer order reorder endpoint. When a customer is logged in, the system does not verify that the order identifier supplied in the request belongs to that customer. An attacker can therefore alter the order ID parameter, causing the platform to load another customer\u2019s order and add those items to their own cart. This flaw enables the attacker to view the contents of other users\u2019 orders, duplicate purchases, and potentially commit fraud. The weak points reflected in CWE-284 and CWE-639 underline the lack of proper access control and user\u2011controlled key validation.", "risk_and_exploitability": "The CVSS score of 7.1 indicates a high severity vulnerability that can result in serious privacy and financial harm. The EPSS score of less than 1% suggests that, as of the latest analysis, exploitation opportunities are currently rare, but the flaw remains present and discoverable by any authenticated account. The vulnerability is not listed in the CISA KEV catalog, yet a public advisory from Bagisto and a commit that fixes the bug have been published. Attackers with a valid user session can exploit the IDOR by simply changing the order identifier in the request, making the risk straightforward to realize without advanced tooling."}}}}, "created": "2026-01-05T10:13:52.144186+00:00", "updated": "2026-04-18T19:30:08.963633+00:00", "vendors": ["webkul", "webkul$PRODUCT$bagisto"]}