CVE-2026-101139: Webkul Bagisto Auth Bypass Vulnerability

CVE-2026-101139 Overview

CVE-2026-101139 is a missing authorization vulnerability in Webkul Bagisto, an open-source Laravel-based e-commerce platform. The flaw affects the /admin/sales/invoices/mass-update/state endpoint within the Invoice Mass Status Update component. An authenticated remote attacker can manipulate invoice state transitions without proper authorization checks. The issue impacts Bagisto versions up to and including 2.4.6 and 2.5.0-beta4, and is resolved in 2.5.0-beta5 via commit 2c34b94d0313824ce98efee8aef8ee141d9b89d0. Public exploit details are available, which raises the practical exposure for administrators running unpatched instances.

Critical Impact

Authenticated attackers with elevated privileges can invoke the invoice mass-update endpoint and alter invoice states without the authorization checks the vendor intended, affecting order processing integrity.

Affected Products

• Webkul Bagisto versions up to 2.4.6
• Webkul Bagisto 2.5.0-beta4
• Fixed in Webkul Bagisto 2.5.0-beta5

Discovery Timeline

• 2026-09-28 - CVE-2026-101139 published to the National Vulnerability Database
• 2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-101139

Vulnerability Analysis

The vulnerability is classified as Missing Authorization [CWE-862]. The affected route /admin/sales/invoices/mass-update/state accepts a request to update the state of multiple invoices at once. The handler does not enforce the authorization policy expected for administrative sales operations. As a result, a remote authenticated caller can trigger state changes on invoice records that the caller should not be permitted to modify.

The vendor confirmed that continuous automated AI-assisted security scanning of the Bagisto codebase had already identified and reproduced the behavior internally. The remediation was delivered through pull request #11493 and merged in the tagged release v2.5.0-beta5.

Root Cause

The root cause is the absence of a proper authorization gate on the mass-update controller action. Bagisto relies on Laravel middleware and policy checks to guard admin routes. The invoice mass-update handler was reachable without the corresponding permission check being applied, so authorization state was never validated before the update executed.

Attack Vector

Exploitation requires network access to the admin surface and an authenticated session with high privileges, per the published CVSS 4.0 vector. No user interaction is required. The attacker submits a crafted request to the vulnerable endpoint to change the state of targeted invoices. The confidentiality and availability impact is none, and the integrity impact is limited to invoice state data.

// Patch snippet: bootstrap/app.php
use Illuminate\Foundation\Configuration\Middleware;
use Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull;
use Illuminate\Foundation\Http\Middleware\PreventRequestsDuringMaintenance;
use Webkul\Core\Http\Middleware\PreventSessionRevival;
use Webkul\Core\Http\Middleware\SecureHeaders;
use Webkul\Installer\Http\Middleware\CanInstall;
// Source: https://github.com/bagisto/bagisto/commit/2c34b94d0313824ce98efee8aef8ee141d9b89d0

The patch introduces a PreventSessionRevival middleware alongside existing security middleware and adjusts the default broadcast connection in .env.example from log to null. See the GitHub commit changes and the pull request discussion for the full authorization fix applied to the mass-update controller.

Detection Methods for CVE-2026-101139

Indicators of Compromise

• Unexpected POST requests to /admin/sales/invoices/mass-update/state originating from admin sessions that do not normally perform bulk operations.
• Bagisto application logs showing invoice state transitions in bursts or outside business hours.
• Audit trail entries indicating invoice status changes without a matching approval workflow record.

Detection Strategies

• Enable Laravel request logging for the /admin/sales/invoices/* route group and alert on requests to mass-update/state.
• Correlate the acting user's role and normal behavior baseline against the invoices modified to identify unauthorized bulk updates.
• Review web server access logs for repeated calls to the mass-update endpoint from a single session.

Monitoring Recommendations

• Monitor Bagisto database changes on the invoices table for state field mutations that lack an associated audit record.
• Track failed and successful admin authentications preceding invoice state changes to identify session abuse.
• Forward Laravel and web server logs to a centralized SIEM for retention and correlation across admin activity.

How to Mitigate CVE-2026-101139

Immediate Actions Required

• Upgrade Bagisto to version 2.5.0-beta5 or later, which contains commit 2c34b94d0313824ce98efee8aef8ee141d9b89d0.
• Audit existing admin user accounts and revoke high-privilege roles that are not strictly required.
• Review recent invoice state changes for unauthorized modifications and reconcile with order records.

Patch Information

The fix is available in the GitHub release v2.5.0-beta5. The remediation was merged through pull request #11493 and applied in commit 2c34b94. Additional advisory context is available in the VulDB CVE report.

Workarounds

• Restrict network access to the Bagisto /admin path to trusted IP ranges using a reverse proxy or web application firewall rule.
• Add a WAF rule that denies requests to /admin/sales/invoices/mass-update/state from users not on an allowlist until the patch is applied.
• Temporarily reduce admin role assignments to limit the number of accounts able to reach the vulnerable endpoint.

# Example nginx rule limiting the vulnerable endpoint to trusted IPs
location = /admin/sales/invoices/mass-update/state {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://bagisto_upstream;
}