CVE-2026-75081: Webkul Bagisto RCE Vulnerability

CVE-2026-75081 Overview

CVE-2026-75081 affects Webkul Bagisto e-commerce platform versions up to 2.4.4. The vulnerability resides in the /customer/account/rma/store endpoint, where manipulation of the rma_qty, resolution_type, and rma_reason_id parameters enables bypass of behavioral workflow enforcement [CWE-840]. Remote authenticated attackers can exploit this flaw over the network with low privileges. The vendor confirms the issue was already identified through internal security assessment prior to notification and is being addressed through their development lifecycle. A public exploit is available.

Critical Impact
Authenticated remote attackers can bypass Return Merchandise Authorization (RMA) workflow controls, potentially manipulating return quantities and resolution types outside the intended business logic constraints.

Affected Products

Webkul Bagisto versions up to and including 2.4.4
Bagisto RMA (Return Merchandise Authorization) module
Customer account subsystem exposed via /customer/account/rma/store

Discovery Timeline

2026-08-18 - CVE-2026-75081 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-75081

Vulnerability Analysis

The vulnerability is classified as a Business Logic Flaw involving improper enforcement of behavioral workflow [CWE-840]. The /customer/account/rma/store handler processes RMA submission requests but fails to enforce the intended state and workflow constraints on user-supplied parameters. Attackers can submit crafted values for rma_qty, resolution_type, and rma_reason_id that violate expected business rules governing valid return quantities, permitted resolution paths, and legitimate reason codes.

Because the endpoint accepts and processes these values without adequate workflow validation, the system enters states that were not intended by the application design. The exploit requires only low-privilege authentication, meaning any registered customer account can invoke the flawed workflow logic.

Root Cause

The root cause is insufficient server-side enforcement of workflow state transitions in the RMA store action. The application relies on client-supplied fields to determine RMA behavior rather than validating each request against a canonical, server-authoritative workflow model. This omission allows parameter manipulation to skip or reorder workflow steps.

Attack Vector

A remote attacker authenticates as a standard customer and issues a POST request to /customer/account/rma/store. By tampering with the rma_qty, resolution_type, or rma_reason_id parameters, the attacker triggers workflow states outside the vendor's intended business logic. No user interaction from a victim is required. Technical details of the request structure are documented in the GitHub Vulnerability Report and VulDB CVE-2026-75081.

No verified code examples are available for this vulnerability. Refer to the linked references for exploitation specifics.

Detection Methods for CVE-2026-75081

Indicators of Compromise

POST requests to /customer/account/rma/store containing anomalous rma_qty values that exceed original order quantities.
Submissions with resolution_type or rma_reason_id values outside the enumerated set defined by the merchant configuration.
Bursts of RMA submissions from a single authenticated customer account within short time windows.

Detection Strategies

Deploy web application firewall (WAF) rules that validate RMA parameters against expected enumerations and quantity boundaries before requests reach the application.
Correlate RMA submissions with the underlying order records to identify workflow states inconsistent with the parent order.
Review Bagisto application logs for repeated failed or unusual RMA transitions tied to the same customer identifier.

Monitoring Recommendations

Enable verbose logging on the RMA controller and forward events to a centralized log analytics platform for retrospective analysis.
Alert on RMA records that reach approval or refund states without traversing the expected intermediate workflow steps.
Track the ratio of RMA submissions to completed orders per customer and flag statistical outliers for manual review.

How to Mitigate CVE-2026-75081

Immediate Actions Required

Restrict access to the RMA subsystem to trusted customer segments while a fix is prepared, using role-based access control at the application or reverse proxy layer.
Add server-side validation that rejects rma_qty values exceeding the original ordered quantity and enforces allowed values for resolution_type and rma_reason_id.
Monitor the vendor's release channel for the upcoming patch, as Webkul confirms remediation is planned for future product releases.

Patch Information

Webkul has stated that the reported issues were identified through internal security assessment prior to external notification. Some items have already been addressed and the remaining items are scheduled for resolution in upcoming Bagisto releases. Administrators should track the VulDB Vulnerability #391309 entry and Webkul release notes for the fixed version, then upgrade beyond Bagisto 2.4.4 as soon as it becomes available.

Workarounds

Implement WAF rules that enforce parameter allowlists for the /customer/account/rma/store endpoint until a vendor patch is applied.
Apply custom server-side validation in a Bagisto plugin or middleware that re-verifies workflow state against the order database on every RMA transition.
Require manual staff approval for RMA state changes involving refunds or high-value items until the underlying workflow enforcement is patched.

bash

# Example nginx location block enforcing rate limits on the RMA endpoint
limit_req_zone $binary_remote_addr zone=rma_limit:10m rate=5r/m;

location = /customer/account/rma/store {
    limit_req zone=rma_limit burst=3 nodelay;
    proxy_pass http://bagisto_backend;
}