CVE-2026-101139

Deferred Deferred - Pending Action

Missing Authorization in Webkul Bagisto Invoice Mass Status Update

Publication date: 2026-09-28

Last updated on: 2026-09-29

Assigner: VulDB

Description

A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 2.5.0-beta5 will fix this issue. The patch is named 2c34b94d0313824ce98efee8aef8ee141d9b89d0. It is recommended to apply a patch to fix this issue. The vendor confirms: "[W]e run continuous automated AI-assisted security scanning across the Bagisto codebase. The behaviour you describe has already been identified and reproduced internally, and it is actively being fixed rather than triaged from scratch."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-28

Last Modified

2026-09-29

Generated

2026-10-19

AI Q&A

2026-09-28

EPSS Evaluated

2026-10-18

NVD

CVE-2026-101139

EUVD

EUVD-2026-88444

Affected Vendors & Products

Vendor	Product	Version / Range
webkul	bagisto	to 2.4.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

A vulnerability exists in Webkul Bagisto versions up to 2.4.6. It involves a missing authorization check in the Invoice Mass Status Update component, specifically in the file /admin/sales/invoices/mass-update/state. This allows remote attackers to manipulate the system without proper authentication.

Detection Guidance

This vulnerability involves missing authorization in the Invoice Mass Status Update component of Webkul Bagisto up to version 2.4.6. To detect it, check for unauthorized access attempts to the /admin/sales/invoices/mass-update/state endpoint. Monitor logs for unusual activity in this path and verify that proper access controls are enforced.

Impact Analysis

The vulnerability could allow unauthorized users to update invoice statuses without proper permissions. This may lead to incorrect financial records, data integrity issues, or unauthorized modifications to sales data. The public availability of the exploit increases the risk of real-world attacks.

Compliance Impact

This vulnerability may impact compliance by allowing unauthorized changes to financial or transactional data, which could violate integrity requirements in GDPR or HIPAA. Missing authorization checks may also fail to meet access control obligations under these regulations.

Mitigation Strategies

Update Webkul Bagisto to the latest version beyond 2.4.6 to address the missing authorization flaw in the Invoice Mass Status Update component.

Hi! I’m here to help you understand CVE-2026-101139. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70