Information Disclosure in Webkul Bagisto via API

Executive Summary

CVE-2026-79409 is a flaw in Bagisto versions 2.4.9 and 2.4.10 where an authenticated customer can manipulate the add-to-cart API to access downloadable files without proper authorization. The issue occurs because the system accepts arbitrary downloadable link identifiers without verifying ownership, allowing an attacker to pay for a cheap product while gaining access to all downloadable files in the catalog.

Useful 0 Not Useful 0

Detection Guidance

Review database entries for downloadable product access logs. Check cart and order fulfillment records for mismatches between purchased products and accessed files. Look for unusual patterns where users access multiple high-value files after purchasing a low-cost item.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to bypass pricing and access control for downloadable products. They can pay for a low-cost item but receive access to all downloadable files, including those of higher value. The attack is silent, as the storefront and admin interfaces do not show unauthorized access, making it hard to detect without direct database review.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection principles if personal or confidential information is exposed. For HIPAA, if the system handles protected health information, the lack of access controls may result in unauthorized disclosure, breaching compliance requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Implement input validation for the `links[]` parameter in the add-to-cart API. Ensure only links belonging to the purchased product are processed during order fulfillment. Temporarily disable downloadable product purchases until a patch is applied.

Useful 0 Not Useful 0