PT-2026-1125 · Bagisto · Bagisto

Mhzcyber · Published 2026-01-02 · Updated 2026-01-03 · CVE-2026-21446

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bagisto versions prior to 2.3.10

Description Bagisto, an open source Laravel eCommerce platform, has an issue where API routes remain active even after the initial installation is complete. The API endpoints (/install/api/*) are directly accessible and exploitable without authentication. This allows an unauthenticated attacker to bypass the installer and create admin accounts, modify application configurations, and potentially overwrite existing data.

Recommendations Update to version 2.3.10 or later.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-21446

GHSA-6H7W-V2XR-MQVW

Affected Products

Bagisto

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21446.json · Exploit
• https://github.com/bagisto/bagisto/commit/380c045e48490da740cd505fb192cc45e1809bed · Patch
• https://github.com/bagisto/bagisto/security/advisories/GHSA-6h7w-v2xr-mqvw · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6h7w-v2xr-mqvw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21446 · Security Note
• https://osv.dev/vulnerability/CVE-2026-21446 · Vendor Advisory
• https://github.com/bagisto/bagisto · Note
• https://t.me/CVEtracker/41294 · Telegram Post
• https://twitter.com/CVEnew/status/2007193953406464217 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2007313786571542626 · Twitter Post