High severity · published Jan 2, 2026
CVE-2026-21447
Bagisto has IDOR in Customer Order Reorder Functionality
7.1
CVSS
0.3%
EPSS
No
On KEV
Description
Bagisto is an open source laravel eCommerce platform. Prior to version 2.3.10, an Insecure Direct Object Reference vulnerability in the customer order reorder function allows any authenticated customer to add items from another customer's order to their own shopping cart by manipulating the order ID parameter. This exposes sensitive purchase information and enables potential fraud. Version 2.3.10 patches the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
bagisto · bagisto
< 2.3.10 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-21447
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-21447
Patch
https://github.com/bagisto/bagisto/commit/b2b1cf62577245d03a68532478cffbe321df74d3
Exploit
https://github.com/bagisto/bagisto/security/advisories/GHSA-x5rw-qvvp-5cgm
More from bagisto
9.8
CVE-2026-21450
Bagisto has SSTI in parameter that can lead to RCE
9.8
CVE-2026-21448
Bagisto has Normal & Blind SSTI from low-privilege user when ordering product
9.8
CVE-2026-21446
Bagisto Missing Authentication on Installer API Endpoints
8.8
CVE-2026-21449
Bagisto has SSTI via first and last name from low-privilege user (not admin)
8.4
CVE-2026-21451
Bagisto has HTML Filter Bypass that Enables Stored XSS