Bagisto CVE-2026-79409: cart links[] authz bypass root-cause & code path

CVE-2026-79409 Vulnerability Summary Overview In Bagisto (the open-source e-commerce platform by Webkul), the middleware accepts an arbitrary list of identifiers when handling the shopping cart, but does not validate whether these identifiers belong to the product currently being purchased. An authenticated customer buying the cheapest downloadable product can inject belonging to other products into the cart, thereby gaining access to those downloadable products for free. CVE: CVE-2026-79409 Product: Bagisto (Webkul Software) Affected Versions: 2.4.9 and 2.4.10 (the latest at time of release) Fixed Version: Unfixed as of 2.4.10 CWE: CWE-639 (Authorization Bypass via User-Controlled Key) CVSS 3.1: 6.5 Medium — Disclosure Timeline: Reported to Webkul on 2026-08-12; after multiple communications, no patch was released; CVE assigned by MITRE on 2026-09-11; publicly disclosed on 2026-09-12. Scope of Impact Affected Endpoint: - Route: , middleware group - Authenticated customer; self-registration is enabled by default, no privilege escalation required - Parameter : Array of downloadable product links; values are not validated Affected Versions: The code paths in 2.4.9 and 2.4.10 are byte-for-byte identical (verified by diffing v2.4.9 and v2.4.10 source code), so all current versions are affected. Impact: The price of any downloadable product in the catalog can be replaced by that of the cheapest product. For merchants whose catalog consists of software, media, e-books, or license keys, this effectively breaks their entire revenue model. Two Aggravating Factors: 1. Link identifiers come from a single global auto-incrementing sequence, so an attacker does not need to know which products exist— can be enumerated. 2. The stored table is only built from a product's own links; injected authorizations are rendered as array storage in both interfaces, and the merchant sees the order as a normal $19.99 purchase. Root Cause (Key Code Paths) 1. Validator does not mention — 2. Pricing only filters the product's own links — External identifiers do not match any item in the loop, so the price is added as 0.00, but the data is still persisted. 3. Unfiltered payload is persisted — 4. Fulfillment accepts any incoming identifier — There is no comparison between and the purchased product. POC / Exploit Code Catalog (4 downloadable products, each with a single "one-file" type link): Steps: 1. Open the cheapest product ($19.99), check its single download checkbox, and submit "Add to Cart" via an intercepting proxy. 2. In the intercepted , replace the single with three items— , , . 3. Complete checkout normally. 4. Complete the invoicing process as an administrator. 5. As a customer, open Account → Downloadable Products and Downloads. Request Example: Cart priced by the purchased product: Fix Implement authoritative validation at the fulfillment stage, and defensive validation at the entry point: 1. Restrict link association to the purchased product — (a single change is sufficient to close the vulnerability) 2. Validate Input — 3. Normalize Before Persistence — In , intersect with before storing, ensuring is self-consistent and the array only receives filtered values. Application Order: Applying only (2) leaves exploitable persisted carts; applying only (3) leaves additional exposure via other write paths; (1) is the necessary fix. TODO: Add for rows that do not belong to any product. References Vendor: https://github.com/bagisto/bagisto CVE Record: https://www.cve.org/CVERecord/?id=CVE-2026-79409

Goal Reached Thanks to every supporter — we hit 100%!

Bagisto CVE-2026-79409: cart links[] authz bypass root-cause & code path

More from this source