Critical severity9.8OSV Advisory· Published Jan 2, 2026· Updated Jun 17, 2026
CVE-2026-21446
CVE-2026-21446
Description
Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation is complete. The underlying API endpoints (/install/api/*) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly. This allows any unauthenticated attacker to create admin accounts, modify application configurations, and potentially overwrite existing data. Version 2.3.10 fixes the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
bagisto/bagistoPackagist | >= 2.3.0, < 2.3.10 | 2.3.10 |
Affected products
3Patches
Vulnerability mechanics
References
4- github.com/bagisto/bagisto/commit/380c045e48490da740cd505fb192cc45e1809bednvdPatchWEB
- github.com/bagisto/bagisto/security/advisories/GHSA-6h7w-v2xr-mqvwnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-6h7w-v2xr-mqvwghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-21446ghsaADVISORY
News mentions
0No linked articles in our index yet.