CVE-2026-79411

An incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding only the settings.users.edit permission to escalate to full administrator. The vulnerable endpoint (UserController::update(), route admin.settings.users.up...