CVE-2026-21446: 
PHP vulnerability analysis and mitigation

CVE-2026-21446 is a missing authentication vulnerability in Bagisto, an open-source Laravel eCommerce platform, affecting the installer API endpoints. In versions 2.3.0 through 2.3.9, the /install/api/* routes remain active and unauthenticated even after initial installation is complete, allowing any remote attacker to create admin accounts, modify application configurations, and overwrite existing data. The vulnerability was disclosed on January 2, 2026, and fixed in version 2.3.10. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 8.8 (High) (Github Advisory, Bagisto Advisory).

The root cause is classified as CWE-306 (Missing Authentication for Critical Function). The vulnerable code resides in packages/Webkul/Installer/src/Routes/web.php, where installer API routes are registered with .withoutMiddleware('web') calls, explicitly stripping the middleware that would otherwise enforce installation-state checks. As a result, endpoints such as /install/api/admin-config-setup, /install/api/run-migration, /install/api/run-seeder, and /install/api/env-file-setup remain fully accessible post-installation with no CSRF token, session, or authentication required. An attacker can directly call these endpoints via a simple HTTP POST request, completely bypassing the installer UI's client-side protections. A public proof-of-concept bash script demonstrating admin account creation via curl was included in the security advisory (Bagisto Advisory, Github Advisory).

Successful exploitation grants an unauthenticated attacker full administrative control over the Bagisto eCommerce platform. An attacker can create rogue admin accounts, alter environment configurations (including database credentials and application keys), run database migrations or seeders, and potentially overwrite existing data — resulting in high confidentiality, integrity, and availability impacts. For e-commerce deployments, this could lead to theft of customer PII, payment data exposure, order manipulation, and complete platform takeover (Bagisto Advisory, Github Advisory).

A public proof-of-concept exploit (a simple curl-based bash script) was published alongside the security advisory on January 2, 2026, making exploitation trivial for any attacker with network access to the target (Github Advisory). The EPSS score is approximately 0.144% (34th percentile), and no evidence of active in-the-wild exploitation has been reported as of the time of disclosure. The vulnerability is not currently listed in the CISA KEV catalog. No specific threat actor attribution has been identified.

1. Reconnaissance: Identify internet-facing Bagisto instances running versions 2.3.0–2.3.9 using search engines (Shodan, Censys) or by probing the /install endpoint for a redirect or installer UI response.
2. Confirm vulnerability: Send a GET request to http://<target>/install — if the installer page or a redirect is returned, the target may be vulnerable. Alternatively, probe /install/api/admin-config-setup with a POST request to check for a non-403 response.
3. Create rogue admin account: Send a direct POST request to /install/api/admin-config-setup with attacker-controlled credentials, bypassing all UI-side protections:

curl -X POST "http://<target>/install/api/admin-config-setup" \
  -H "Content-Type: application/json" \
  -d '{"admin_name": "Attacker", "admin_email": "attacker@evil.com", "admin_password": "HackedPassword123"}'

4. Authenticate as admin: Log in to the Bagisto admin panel at http://<target>/admin using the newly created credentials.
5. Achieve full platform control: From the admin panel, access customer data, modify store configurations, install plugins, or further pivot within the hosting environment (Bagisto Advisory, Github Advisory).

• Network: Unexpected POST requests to /install/api/admin-config-setup, /install/api/env-file-setup, /install/api/run-migration, /install/api/run-seeder, or /install/api/sample-products-setup from external IP addresses after initial installation.
• Logs: Web server access logs showing HTTP 200 responses to /install/api/* endpoints from unauthenticated sessions; Laravel application logs (storage/logs/laravel.log) showing new admin insertions or configuration changes outside of normal deployment windows.
• Database: Unexpected new entries in the admins table with unfamiliar email addresses, names, or creation timestamps; changes to environment-related configuration tables.
• File System: Modifications to the .env file with altered APP_KEY, database credentials, or other configuration values at unexpected times.

Upgrade Bagisto to version 2.3.10 or later, which fixes the issue by updating the CanInstall middleware to return a 403 JSON response for AJAX requests to installer endpoints when the application is already installed, blocking all unauthenticated post-installation access to /install/api/* routes (Bagisto Commit). As an interim workaround for organizations unable to patch immediately, restrict access to the /install/api/* URL paths at the web server or firewall level (e.g., via Nginx location blocks or WAF rules). After patching, audit the admins database table and application configuration for unauthorized changes made prior to remediation (Github Advisory).

The vulnerability was reported by security researcher mhzcyber and published by Bagisto maintainer devansh-webkul via GitHub Security Advisories on January 2, 2026. The issue was picked up by automated vulnerability tracking services including Qualys (detection IDs 5006776 and 530825), INCIBE-CERT, and GitLab Advisory Database shortly after disclosure. No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified (Github Advisory).