Executive brief
Webkul Bagisto is an open-source e-commerce platform that includes a Return Merchandise Authorization (RMA) system for managing customer returns and refunds. A flaw in the RMA state management allows customers to bypass business logic rules and force-close or cancel return requests in states where the web interface should block these actions. This enables customers to prematurely terminate support workflows, potentially disrupting after-sales operations and creating audit trail inconsistencies.
Technical details
The vulnerability is a server-side business logic bypass in the RMA state validation mechanism. The backend endpoints /customer/account/rma/update-status and /customer/account/rma/cancel do not fully validate whether state transitions are allowed in the current RMA state; they only check ownership and basic conditions. An authenticated customer can craft direct POST requests to force an RMA from states like DECLINED to SOLVED or cancel an already-solved request, actions the frontend explicitly prevents by hiding the relevant UI controls. The vulnerability requires authentication and remote network access. The impact is workflow manipulation and integrity compromise rather than data exposure, though it can create confusion in support operations and corrupt audit logs.
Affected products
- Webkul Bagisto up to 2.4.4
Timeline
- 2026-08-17: disclosed
- 2026-08-17: advisory