CVE-2026-79411

Webkul Bagisto 2.4.9 has an incorrect privilege assignment in its admin user-management component. The endpoint UserController::update() (route admin.settings.users.update) fails to verify that the acting user is authorized to grant the requested role, does not block self-role changes, and does n...

EUVD-2026-79300

Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding only the settings.users.edit permission to escalate to full administrator. The user-update endpoint route admin.settings.users.update, UserController::update...