CVE-2026-79411

Webkul Bagisto 2.4.9 contains a vertical privilege escalation in the admin user-management component. The user-update endpoint (admin.settings.users.update / UserController::update()) fails to verify that the actor is authorized to grant the requested role, allows a user to change their own role,...