Missing Authorization in Webkul Bagisto Invoice Mass Status Update Component
CVE-2026-101139

5.1MEDIUM

Key Information:

Vendor: Webkul
Status: Bagisto
Vendor: CVE Published:; 28 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-101139?

A vulnerability has been identified in Webkul Bagisto versions up to 2.4.6 concerning the Invoice Mass Status Update component. Specifically, a lack of proper authorization in an unknown function within the file /admin/sales/invoices/mass-update/state allows attackers to manipulate the system remotely. This vulnerability can enable unauthorized individuals to perform actions without the necessary permissions. As the exploit for this vulnerability has been made public, it poses a significant risk to affected users. The vendor has been notified early regarding this issue.

Affected Version(s)

Bagisto 2.4.0

Bagisto 2.4.1

Bagisto 2.4.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-101139 - Proof of Concept