{"id":"CVE-2026-101139","revision":"8b0214f4ac2c4b02be87710e32b81fb3","records":[{"revision":"8b0214f4ac2c4b02be87710e32b81fb3","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-101139","aliases":[],"title":"Webkul Bagisto Invoice Mass Status Update state authorization","description":"A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 2.5.0-beta5 will fix this issue. The patch is named 2c34b94d0313824ce98efee8aef8ee141d9b89d0. It is recommended to apply a patch to fix this issue. The vendor confirms: \"[W]e run continuous automated AI-assisted security scanning across the Bagisto codebase. The behaviour you describe has already been identified and reproduced internally, and it is actively being fixed rather than triaged from scratch.\"","state":0,"publishedAt":"2026-09-28T19:00:11.265+00:00","modifiedAt":"2026-09-29T16:30:39.149+00:00","affected":[{"ecosystem":"Vendor product","name":"Bagisto","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Webkul\",\n                    \"product\": \"Bagisto\",\n                    \"versions\": [\n                        {\n                            \"version\": \"2.4.0\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"2.4.1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"2.4.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"2.4.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"2.4.4\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"2.4.5\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"2.4.6\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"2.5.0-beta1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"2.5.0-beta2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"2.5.0-beta3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"2.5.0-beta4\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"2.5.0-beta5\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:2.3:a:webkul:bagisto:*:*:*:*:*:*:*:*\"\n                    ],\n                    \"modules\": [\n                        \"Invoice Mass Status Update\"\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","score":5.1,"severity":"MEDIUM"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C","score":2.7,"severity":"LOW"},{"system":"CVSS 3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C","score":2.7,"severity":"LOW"},{"system":"CVSS 2.0","vector":"AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:OF/RC:C","score":3.3,"severity":null}],"references":["https://vuldb.com/vuln/410992","https://vuldb.com/vuln/410992/cti","https://vuldb.com/cve/CVE-2026-101139","https://vuldb.com/submit/894633","https://drive.google.com/file/d/1ymuUIZJaHZ7oDyebyLKn9RfRPAzDKMmm/view","https://github.com/bagisto/bagisto/pull/11493","https://github.com/bagisto/bagisto/commit/2c34b94d0313824ce98efee8aef8ee141d9b89d0","https://github.com/bagisto/bagisto/releases/tag/v2.5.0-beta5"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-101139","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-101139","identifiers":["CVE-2026-101139"]},"retained":false,"historicalAffected":[]}],"coverage":[]}