CVE-2024-44314 TastyIgniter Has an Incorrect Access Control Vulnerability

What is CVE-2024-44314?

CVE-2024-44314 is a medium-severity missing authorization vulnerability in n/a, published on 18 Mar 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the Orders Management System, allowing unauthorized users to update order statuses. The issue occurs in the index_onUpdateStatus() function within Orders.php, which fails to verify if the user has permission to modify an order's status. This flaw can be exploited remotely, leading to unauthorized order manipulation.

Weakness: CWE-285

Which versions are affected by CVE-2024-44314?

2 open source packages ship an affected version, including tastyigniter/tastyigniter. It affects 1 product.

Products include Tastyigniter Tastyigniter.

How do I fix CVE-2024-44314?

Upgrade tastyigniter/tastyigniter to 4.0.0 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-44314 being exploited?

There is no known exploitation of CVE-2024-44314 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2025-61417 TastyIgniter vulnerable to Cross-Site Scripting High 8.8
• CVE-2024-44313 TastyIgniter Has an Incorrect Access Control Vulnerability via `invoice()` Function High 8.1
• CVE-2022-0602 Cross-site Scripting (XSS) - DOM in tastyigniter/tastyigniter High 7.4
• CVE-2022-38256 Cross-site scripting in n/a Medium 5.4
• CVE-2022-23378 Cross-site scripting in n/a Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w5h7-mw56-4v7x.