CVE-2026-79411: Improper Privilege Management

Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding only the settings.users.edit permission to escalate to full administrator. The user-update endpoint route admin.settings.users.update, UserController::update...

CVE-2025-13808

CVE-2025-13808 affects orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1, specifically the update function in UserController.java of the User Profile Handler. The vulnerability arises from manipulation of the argument ID leading to improper authorization, with remote exploitation ...