CVE-2026-21447 Bagisto has IDOR in Customer Order Reorder Functionality

High 7.1 Published 2 Jan 2026 Updated 2 Jan 2026

Authenticated users can access other customers' order details and add items to their cart by manipulating order IDs, exposing sensitive data and enabling fraud.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-21447?

CVE-2026-21447 is a high-severity missing authorization vulnerability in bagisto, published on 2 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Bagisto is an open source laravel eCommerce platform. Prior to version 2.3.10, an Insecure Direct Object Reference vulnerability in the customer order reorder function allows any authenticated customer to add items from another customer's order to their own shopping cart by manipulating the order ID parameter. This exposes sensitive purchase information and enables potential fraud. Version 2.3.10 patches the issue.

Weakness: CWE-639, CWE-284

Which versions are affected by CVE-2026-21447?

2 open source packages ship an affected version, including bagisto/bagisto. It affects 1 product.

Package	Affected	Fixed in
`bagisto/bagisto` Packagist	All versions	`2.3.10`
`bagisto/bagisto` Packagist	All versions	`2.3.10`

Products include Webkul Bagisto.

How do I fix CVE-2026-21447?

Upgrade bagisto/bagisto to 2.3.10 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-21447 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-21447 exists.

Sources

Also known as GHSA-x5rw-qvvp-5cgm.