CVE-2026-21447

HIGH

7.1

Description

Bagisto is an open source laravel eCommerce platform. Prior to version 2.3.10, an Insecure Direct Object Reference vulnerability in the customer order reorder function allows any authenticated customer to add items from another customer's order to their own shopping cart by manipulating the order ID parameter. This exposes sensitive purchase information and enables potential fraud. Version 2.3.10 patches the issue.

CVE Details

CVSS v3.1 Score7.1

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

Published1/2/2026

Last Modified1/8/2026

Sourcenvd

Honeypot Sightings0

Affected Products

webkul:bagisto

Weaknesses (CWE)

CWE-284CWE-639

References

https://github.com/bagisto/bagisto/commit/b2b1cf62577245d03a68532478cffbe321df74d3(security-advisories@github.com)

https://github.com/bagisto/bagisto/security/advisories/GHSA-x5rw-qvvp-5cgm(security-advisories@github.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.