Bagisto has IDOR in Customer Order Reorder Functionality_CVE-2026-21447

7.1 / 10

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Description

Bagisto is an open source laravel eCommerce platform. Prior to version 2.3.10, an Insecure Direct Object Reference vulnerability in the customer order reorder function allows any authenticated customer to add items from another customer's order to their own shopping cart by manipulating the order ID parameter. This exposes sensitive purchase information and enables potential fraud. Version 2.3.10 patches the issue.

Basic Information

ID CVE-2026-21447

Source GitHub_M

Published Jan 2, 2026 at 20:15

Affected Product

Vendor bagisto

Product bagisto

Version < 2.3.10

Affected Versions bagisto bagisto < 2.3.10

CWE Classification

CWE-284 CWE-639

References

{
    "lastseen": "",
    "description": "Bagisto is an open source laravel eCommerce platform. Prior to version 2.3.10, an Insecure Direct Object Reference vulnerability in the customer order reorder function allows any authenticated customer to add items from another customer's order to their own shopping cart by manipulating the order ID parameter. This exposes sensitive purchase information and enables potential fraud. Version 2.3.10 patches the issue.",
    "published": "2026-01-02T20:15:11.750Z",
    "modified": "2026-01-02T20:15:11.750Z",
    "type": "cve",
    "title": "Bagisto has IDOR in Customer Order Reorder Functionality",
    "source": "GitHub_M",
    "references": "https://github.com/bagisto/bagisto/security/advisories/GHSA-x5rw-qvvp-5cgm\nhttps://github.com/bagisto/bagisto/commit/b2b1cf62577245d03a68532478cffbe321df74d3",
    "id": "CVE-2026-21447",
    "bulletinFamily": "",
    "cwe": [
        "CWE-284",
        "CWE-639"
    ],
    "cvelist": null,
    "sourceData": "bagisto bagisto < 2.3.10",
    "sourceHref": "",
    "cvss": {
        "score": 7.1,
        "severity": "HIGH",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "bagisto",
    "version": "< 2.3.10",
    "vendor": "bagisto",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}