CVE-2026-21446 is a critical missing authentication flaw (CVSS 9.8) in Bagisto, the Laravel e-commerce platform. On the 2.3 branch before 2.3.10, the installer API stays reachable after setup and needs no login. That allows admin account creation and configuration changes. Upgrade to 2.3.10.
What's affected
The record and the GitHub advisory GHSA-6h7w-v2xr-mqvw name the Bagisto 2.3 branch and say the fix is version 2.3.10. The weakness is CWE-306 (missing authentication for a critical function). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, so it is reachable over the network with no account and no user interaction.
The advisory says API routes under the installer path stay active after installation is complete, and that an attacker can skip the web installer by calling them directly. The record says this lets any unauthenticated attacker create admin accounts, change application configuration and potentially overwrite files. Two sibling records from the same release, CVE-2026-21448 and CVE-2026-21450, cover template injection and also name 2.3.10 as the fix.
The record does not mark the issue as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Find your Bagisto version in your project files.
grep -i bagisto composer.lock | head
Then check whether the installer route answers on your live store. Run this against your own site only.
curl -s -o /dev/null -w "%{http_code}\n" https://your-store.example/install
A finished installation should not serve the installer page. Also review the admin user list for accounts you did not create, and compare the application configuration file with your last known good copy. Check web server logs for requests to paths beginning with /install/api after the date of your installation.
What to do now
- Upgrade Bagisto to 2.3.10 or later, and test the storefront and admin after the upgrade.
- Block the /install route and the /install/api paths at the web server or the reverse proxy on any live store, whatever the version.
- List all admin accounts and remove any you cannot explain. Rotate passwords for the remaining ones and turn on two factor authentication if you use it.
- Compare the application environment file, configuration and any recently changed PHP files with a trusted copy. Restore from a known good backup if you find changes you cannot explain.
- Rotate secrets held by the store: application key, database password and payment or shipping credentials, if you saw signs of misuse.
- Check for the sibling issues CVE-2026-21448 and CVE-2026-21450, which the same upgrade fixes.
Why it matters
Installers are meant to run once. Their routes can create administrators and write configuration, so they have to be switched off or locked after setup. Here the routes stayed registered, and the code did not check whether the installation was already done or whether the caller was allowed. Anyone who finds the path can use it.
The result is the full chain for a store: an admin account, access to orders and customer data, and a way to change settings or files. The score of 9.8 reflects that. It also means an upgrade alone may not be enough if the store was reachable for some time. A rogue admin account survives an upgrade.
The lasting lesson is simple. Remove or block setup code on a live system, and test with a script that calls known framework paths unauthenticated. A dynamic scan of your storefront does the second part, as the demo shows.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is upgrading enough?
Upgrading closes the hole. If the store was reachable from the internet before the upgrade, also check for accounts and files that changed, because those survive the upgrade.
Does this affect other Bagisto branches?
The record names the 2.3 branch before 2.3.10. If you run another branch, check the advisory and the release notes for your version.
Sources
- GitHub advisory GHSA-6h7w-v2xr-mqvw for Bagisto
- Fix commit in the Bagisto repository
- NVD record for CVE-2026-21446
Last reviewed: 19 October 2026.
