CVE-2026-21447 json
Bagisto has IDOR in Customer Order Reorder Functionality
published 2026-01-02 10 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-0748 , GHSA-x5rw-qvvp-5cgm
- cvss
- 7.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 23%
- public exploits
- 0
- none known
Summary
Bagisto is an open source laravel eCommerce platform. Prior to version 2.3.10, an Insecure Direct Object Reference vulnerability in the customer order reorder function allows any authenticated customer to add items from another customer's order to their own shopping cart by manipulating the order ID parameter. This exposes sensitive purchase information and enables potential fraud. Version 2.3.10 patches the issue.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 10 mo ago
Exploit prediction
0.30% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/bagisto/bagisto/security/advisories/GHSA-x5rw-qvvp-5cgm referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
| GitHub | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | bagisto/bagisto | <2.3.10 |
2.3.10 |
Affected products
- bagisto bagisto
Classification
References
-
github.com
/bagisto/bagisto/commit/b2b1cf62577245d03a68532478cffbe321df74d3
web, patch
-
github.com
/bagisto/bagisto/security/advisories/GHSA-x5rw-qvvp-5cgm
web, exploit, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-21447
advisory
-
github.com
/bagisto/bagisto
package
Sources
- CVE List CVE-2026-21447
- GitHub Advisory GHSA-x5rw-qvvp-5cgm
- NVD CVE-2026-21447
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.