Webkul Bagisto Invoice Mass Status Update state authorization
A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 2.5.0-beta5 will fix this issue. The patch is named 2c34b94d0313824ce98efee8aef8ee141d9b89d0. It is recommended to apply a patch to fix this issue. The vendor confirms: "[W]e run continuous automated AI-assisted security scanning across the Bagisto codebase. The behaviour you describe has already been identified and reproduced internally, and it is actively being fixed rather than triaged from scratch."
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-101139
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 15:05 UTC · Revision 1
Source evidence
Webkul Bagisto Invoice Mass Status Update state authorization
core-osv · Original sourcePublished 28 Sept 2026, 19:00 UTC
A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 2.5.0-beta5 will fix this issue. The patch is named 2c34b94d0313824ce98efee8aef8ee141d9b89d0. It is recommended to apply a patch to fix this issue. The vendor confirms: "[W]e run continuous automated AI-assisted security scanning across the Bagisto codebase. The behaviour you describe has already been identified and reproduced internally, and it is actively being fixed rather than triaged from scratch."
osv:CVE-2026-101139
Complete source record
{
"id": "ac88e939870dbc0729678a0d142f6cdc899c84ca5b6c414a4b55bdc0f5fd117a",
"url": "https://osv.dev/vulnerability/CVE-2026-101139",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Webkul Bagisto Invoice Mass Status Update state authorization",
"summary": "A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 2.5.0-beta5 will fix this issue. The patch is named 2c34b94d0313824ce98efee8aef8ee141d9b89d0. It is recommended to apply a patch to fix this issue. The vendor confirms: \"[W]e run continuous automated AI-assisted security scanning across the Bagisto codebase. The behaviour you describe has already been identified and reproduced internally, and it is actively being fixed rather than triaged from scratch.\"",
"evidence": "osv:CVE-2026-101139",
"products": [],
"severity": "low",
"structured": {
"id": "CVE-2026-101139",
"aliases": [
"CVE-2026-101139"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/bagisto/bagisto",
"type": "GIT",
"events": [
{
"introduced": "487533a8f8552b94c937722cc3109ae41afc7604"
},
{
"fixed": "2c34b94d0313824ce98efee8aef8ee141d9b89d0"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "2.4.0"
},
{
"last_affected": "2.4.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "2.4.1"
},
{
"last_affected": "2.4.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "2.4.2"
},
{
"last_affected": "2.4.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "2.4.3"
},
{
"last_affected": "2.4.3"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "2.4.4"
},
{
"last_affected": "2.4.4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "2.4.5"
},
{
"last_affected": "2.4.5"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "2.4.6"
},
{
"last_affected": "2.4.6"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "2.5.0-beta1"
},
{
"last_affected": "2.5.0-beta1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "2.5.0-beta2"
},
{
"last_affected": "2.5.0-beta2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "2.5.0-beta3"
},
{
"last_affected": "2.5.0-beta3"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "2.5.0-beta4"
},
{
"last_affected": "2.5.0-beta4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"fixed": "2c34b94d0313824ce98efee8aef8ee141d9b89d0"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "2c34b94d0313824ce98efee8aef8ee141d9b89d0"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v2.5.0-beta5"
}
]
}
}
],
"versions": [
"2.4.0",
"2.4.1",
"2.4.2",
"2.4.3",
"2.4.4",
"2.4.5",
"2.4.6",
"2.5.0-beta1",
"2.5.0-beta2",
"2.5.0-beta3",
"2.5.0-beta4",
"v2.5.0-beta4",
"v2.5.0-beta2",
"v2.5.0-beta1",
"v2.4.1",
"v2.4.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-101139.json"
}
}
],
"modified": "2026-10-28T02:30:29.928155244Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101139.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-101139",
"https://vuldb.com/cve/CVE-2026-101139",
"https://vuldb.com/submit/894633",
"https://vuldb.com/vuln/410992",
"https://vuldb.com/vuln/410992/cti",
"https://github.com/bagisto/bagisto/commit/2c34b94d0313824ce98efee8aef8ee141d9b89d0",
"https://github.com/bagisto/bagisto/pull/11493",
"https://github.com/bagisto/bagisto/releases/tag/v2.5.0-beta5",
"https://drive.google.com/file/d/1ymuUIZJaHZ7oDyebyLKn9RfRPAzDKMmm/view"
],
"provider_metadata": {
"cwe_ids": [
"CWE-862",
"CWE-863"
],
"cna_assigner": "VulDB",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101139.json"
}
},
"related_cves": [
{
"value": "CVE-2026-101139",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 496651,
"published_at": "2026-09-28T19:00:11.265+00:00"
}