Description

A security flaw has been discovered in Webkul Bagisto up to 2.4.4. This issue affects some unknown processing of the file /admin/sales/rma/requests of the component Backend Sales RMA Endpoint. Performing a manipulation results in authorization bypass. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-17T07:17:15.643Z",
  "pubdate": "2026-08-17T07:17:15.643Z",
  "executiveSummary": "An authorization bypass vulnerability has been identified in Webkul Bagisto up to version 2.4.4, specifically within the Backend Sales RMA Endpoint processing the file /admin/sales/rma/requests. This security flaw enables remote attackers to bypass access control mechanisms and interact with administrative RMA request processing functionalities without proper authorization.\nThe vulnerability exposes critical backend business logic to unauthorized entities, potentially leading to unauthorized data exposure, modification, or process manipulation within the affected e-commerce platform. The risk is significantly elevated due to the public release of exploit material, increasing the likelihood of active exploitation attempts against vulnerable deployments.\nAttacker capabilities include remote execution of unauthorized administrative requests targeting the sales Return Merchandise Authorization workflow. Exploitation relies on network connectivity to the target application and manipulation of HTTP requests targeting the vulnerable endpoint.\nOrganization deployments running Webkul Bagisto up to version 2.4.4 face immediate risk until appropriate remediation is applied, as vendors address identified internal security assessment findings through established release lifecycles.",
  "technicalDetails": "The vulnerability resides in the Backend Sales RMA Endpoint of Webkul Bagisto up to version 2.4.4, specifically associated with the processing mechanics of the file /admin/sales/rma/requests. The root cause stems from insufficient authorization checks or broken access control enforcement within the administrative routing and request handling pipeline.\nUnder normal operational conditions, access to the /admin/sales/rma/requests endpoint requires administrative privileges and valid session authentication to manage customer Return Merchandise Authorization requests. However, due to the authorization bypass flaw, the application fails to adequately validate whether the incoming request originates from an authenticated user possessing the required administrative roles and permissions.\nThe attack vector is remote, allowing an unauthorized threat actor to transmit crafted HTTP requests directly to the vulnerable endpoint over the network. By manipulating request parameters or bypassing preceding access control filters, the attacker can successfully invoke backend controller methods and logic associated with sales RMA processing.\nStep-by-step exploitation involves the attacker identifying the exposed /admin/sales/rma/requests path within the administrative routing structure. The attacker then constructs a malicious HTTP request designed to bypass authorization middleware or session validation checks. Upon transmission, the application processes the request under the assumption of valid administrative context, executing the underlying business logic and granting unauthorized access to sensitive sales RMA functions and associated data.\nThe post-exploitation impact includes unauthorized viewing, manipulation, or processing of RMA requests, which could disrupt business operations, compromise sensitive customer and transactional data, and lead to further administrative compromise depending on the depth of backend integration associated with the vulnerable endpoint."
}