CVE-2026-21446: Webkul Bagisto Auth Bypass Vulnerability

CVE-2026-21446 Overview

CVE-2026-21446 is an authentication bypass vulnerability in Bagisto, an open source Laravel eCommerce platform developed by Webkul. The vulnerability exists in versions on the 2.3 branch prior to 2.3.10, where API routes remain active even after initial installation is complete. The underlying API endpoints (/install/api/*) are directly accessible and exploitable without any authentication, allowing attackers to bypass the installer entirely by calling the API endpoints directly.

Critical Impact

This vulnerability allows any unauthenticated attacker to create admin accounts, modify application configurations, and potentially overwrite existing data on vulnerable Bagisto installations.

Affected Products

• Webkul Bagisto versions 2.3.x prior to 2.3.10
• All deployments with exposed /install/api/* endpoints
• Self-hosted Bagisto eCommerce installations

Discovery Timeline

• 2026-01-02 - CVE CVE-2026-21446 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2026-21446

Vulnerability Analysis

This vulnerability is classified as CWE-306 (Missing Authentication for Critical Function). The core issue stems from installer API routes that remain accessible after the Bagisto installation process completes. These endpoints were designed to facilitate the initial setup workflow but were not properly disabled or protected once installation finished.

The vulnerability enables complete administrative takeover of Bagisto installations. An attacker can leverage the exposed API endpoints to create new administrator accounts with full privileges, modify critical application configurations, and potentially corrupt or overwrite existing store data. This represents a severe breach of the application's security boundary, as no authentication is required to access these sensitive installation functions.

Root Cause

The root cause is improper access control on the installer API endpoints. The application fails to enforce authentication checks on the /install/api/* routes, and there is no mechanism to disable these routes after installation completes. The fix introduces a skip_admin_creation parameter check and enhances security in the Sanitizer component.

Attack Vector

The attack vector is network-based, requiring no authentication and no user interaction. An attacker with network access to a vulnerable Bagisto instance can directly call the installer API endpoints to perform administrative actions. The exploitation is straightforward—simply sending crafted HTTP requests to the /install/api/* endpoints allows full control over the installation process, including admin account creation and configuration changes.

// Security patch in AdminsTableSeeder.php adding skip_admin_creation check
// Source: https://github.com/bagisto/bagisto/commit/380c045e48490da740cd505fb192cc45e1809bed

         $defaultLocale = $parameters['default_locale'] ?? config('app.locale');
 
+        if (isset($parameters['skip_admin_creation']) && $parameters['skip_admin_creation']) {
+            return;
+        }
+
         DB::table('admins')->insert([
             'id'         => 1,
             'name'       => trans('installer::app.seeders.user.users.name', [], $defaultLocale),

// Security patch in Sanitizer.php enhancing SVG sanitization with remote reference removal
// Source: https://github.com/bagisto/bagisto/commit/380c045e48490da740cd505fb192cc45e1809bed

     public function sanitizeSVG($path, $mimeType)
     {
         if ($this->checkMimeType($mimeType)) {
-            /* sanitizer instance */
             $sanitizer = new MainSanitizer;
 
-            /* grab svg file */
+            $sanitizer->removeRemoteReferences(true);
+
             $dirtySVG = Storage::get($path);
 
-            /* save sanitized svg */
             Storage::put($path, $sanitizer->sanitize($dirtySVG));
         }
     }

Detection Methods for CVE-2026-21446

Indicators of Compromise

• Unexpected HTTP requests to /install/api/* endpoints in web server access logs
• Creation of new administrator accounts without authorized user action
• Unauthorized modifications to application configuration files or database settings
• Anomalous API traffic patterns targeting installation-related endpoints

Detection Strategies

• Monitor web server logs for requests to /install/api/* paths from external IP addresses
• Implement web application firewall (WAF) rules to alert on or block access to installer API routes
• Review admin user tables for unauthorized account creation with elevated privileges
• Deploy file integrity monitoring on Bagisto configuration files

Monitoring Recommendations

• Enable verbose logging for API endpoint access and authentication events
• Configure SIEM alerts for patterns indicating installer API exploitation attempts
• Perform regular audits of administrator accounts and their creation timestamps
• Monitor for unexpected database modifications to the admins table

How to Mitigate CVE-2026-21446

Immediate Actions Required

• Upgrade Bagisto to version 2.3.10 or later immediately
• Block access to /install/api/* endpoints at the web server or firewall level
• Audit existing administrator accounts for any unauthorized entries
• Review application logs for evidence of prior exploitation

Patch Information

The vulnerability is fixed in Bagisto version 2.3.10. The patch is available via the GitHub Commit. For detailed information about the vulnerability and remediation, refer to the GitHub Security Advisory GHSA-6h7w-v2xr-mqvw.

Workarounds

• Block all requests to /install/api/* paths using web server configuration or reverse proxy rules
• Implement network-level access controls to restrict access to the Bagisto admin panel and API
• Consider placing the application behind a VPN or IP whitelist if immediate patching is not possible

# Nginx configuration to block installer API endpoints
location ~ ^/install/api {
    deny all;
    return 403;
}

# Apache .htaccess rule to block installer API endpoints
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^install/api - [F,L]
</IfModule>