PT-2026-1127 · Bagisto · Bagisto

Denizparlak · Published 2026-01-02 · Updated 2026-01-04 · CVE-2026-21447

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Bagisto versions prior to 2.3.10

Description An Insecure Direct Object Reference issue exists in the customer order reorder function. This allows authenticated customers to add items from another customer's order to their own shopping cart by manipulating the order ID parameter. This can expose sensitive purchase information and potentially enable fraud.

Recommendations Update to version 2.3.10 or later.

Exploit

Fix

Improper Access Control

IDOR

Weakness Enumeration

CWE-284

CWE-639

Related Identifiers

CVE-2026-21447

GHSA-X5RW-QVVP-5CGM

Affected Products

Bagisto

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21447.json · Exploit
• https://github.com/bagisto/bagisto/commit/b2b1cf62577245d03a68532478cffbe321df74d3 · Patch
• https://github.com/bagisto/bagisto/security/advisories/GHSA-x5rw-qvvp-5cgm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21447 · Security Note
• https://osv.dev/vulnerability/CVE-2026-21447 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x5rw-qvvp-5cgm · Vendor Advisory
• https://github.com/bagisto/bagisto · Note
• https://twitter.com/pulsepatchio/status/2007825202516746412 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2007311226649391264 · Twitter Post
• https://twitter.com/CVEnew/status/2007193951334477899 · Twitter Post
• https://t.me/CVEtracker/41295 · Telegram Post