The flaw resides in the Bagisto backend component that manages return‑merchandise‑authorizations. An attacker can manipulate requests to the /admin/sales/rma/requests endpoint and gain authorization that they should not possess. This results in privilege escalation within the administrative interface, allowing the attacker to view, alter, or export restricted sales data. The underlying weakness is an improper checking of the user's credentials (CWE‑285) combined with missing verification of required workflow steps (CWE‑639). The impact is therefore elevated rights for the victim role rather than full remote code execution, but it enables the attacker to read or change sensitive order information.

Webkul Bagisto versions up to and including 2.4.4 are affected. The vulnerability is tied specifically to the backend Sales RMA Endpoint and does not impact the public storefront or other modules without explicit access to the /admin/sales/rma/requests route.

The CVSS score of 5.1 places this issue in the medium severity range. Ephemeral public exploitation details exist, but the EPSS score is unavailable, so the probability of widespread attack is uncertain, yet the exploit has already been released to the public. The vulnerability can be activated remotely by sending crafted HTTP requests to the affected endpoint. As it is not listed in the CISA KEV catalog, there are currently no mandated containment directives, but the authorization bypass means attackers can gain significant business‑critical information and potentially alter orders, posing a meaningful threat to confidentiality and integrity.