CVE-2026-101139

Webkul Bagisto Invoice Mass Status Update state authorization

State: Published
Severity: 5.1 Medium
Published: Sep 28, 2026
Updated: Sep 29, 2026
Reserved: Sep 28, 2026

Description

A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 2.5.0-beta5 will fix this issue. The patch is named 2c34b94d0313824ce98efee8aef8ee141d9b89d0. It is recommended to apply a patch to fix this issue. The vendor confirms: "[W]e run continuous automated AI-assisted security scanning across the Bagisto codebase. The behaviour you describe has already been identified and reproduced internally, and it is actively being fixed rather than triaged from scratch."

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	2.7 Low	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C	VulDB
3.0	2.7 Low	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C	VulDB
2.0	3.3 Low	AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-862 Missing Authorization
CWE-863 Incorrect Authorization

Affected Products

Product	Versions
BagistoWebkul	2.4.0Affected 2.4.1Affected 2.4.2Affected 2.4.3Affected 2.4.4Affected 2.4.5Affected 2.4.6Affected 2.5.0-beta1Affected 2.5.0-beta2Affected 2.5.0-beta3Affected 2.5.0-beta4Affected 2.5.0-beta5Not affected

References

VDB-410992 | Webkul Bagisto Invoice Mass Status Update state authorizationvdb-entry
VDB-410992 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-101139 | CVE Analysis and Reportthird-party-advisory
Submit #894633 | Webkul Bagisto 2.4.6 Missing Authorizationthird-party-advisory
https://drive.google.com/file/d/1ymuUIZJaHZ7oDyebyLKn9RfRPAzDKMmm/viewexploit
https://github.com/bagisto/bagisto/pull/11493issue-trackingpatch
https://github.com/bagisto/bagisto/commit/2c34b94d0313824ce98efee8aef8ee141d9b89d0patch
https://github.com/bagisto/bagisto/releases/tag/v2.5.0-beta5patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.