CVE-2026-21447
High · 7.1Bagisto has IDOR in Customer Order Reorder Functionality
CVSS
7.1
EPSS
0.3%
Published
Jan 2, 2026
CISA due date
—
The record
An Insecure Direct Object Reference vulnerability in the customer order reorder function allows any authenticated customer to add items from another customer's order to their own shopping cart by manipulating the order ID parameter. This exposes sensitive purchase information and enables potential fraud.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | bagisto/bagisto | 0 | 2.3.10 |
Related vulnerabilities
- GHSA-x5rw-qvvp-5cgm Bagisto has IDOR in Customer Order Reorder Functionality Same vulnerability
- GHSA-mqhg-v22x-pqj8 Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege… Also affects bagisto/bagisto
- GHSA-5j4h-4f72-qpm6 Bagisto has Normal & Blind SSTI from low-privilege user when ordering product Also affects bagisto/bagisto
- GHSA-9hvg-qw5q-wqwp Bagisto SSTI vulnerability in type parameter can lead to RCE Also affects bagisto/bagisto
- GHSA-2mwc-h2mg-v6p8 Bagisto has HTML Filter Bypass that Enables Stored XSS Also affects bagisto/bagisto
- GHSA-6h7w-v2xr-mqvw Bagisto Missing Authentication on Installer API Endpoints Also affects bagisto/bagisto
- CVE-2026-21449 Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege… Also affects bagisto/bagisto
- CVE-2026-21446 Bagisto Missing Authentication on Installer API Endpoints Also affects bagisto/bagisto