An authenticated backend user with only the "settings.users.edit" permission can falsely elevate privileges by updating their own record to the Administrator role via the user‑update endpoint. The endpoint omits checks that would normally restrict role changes to those the actor is authorized to grant, allowing a low‑privileged administrator to gain full administrative control, including configuration, payment gateway, and customer PII access.

Webkul Bagisto 2.4.9, deployed by merchants with backend user management enabled. The flaw targets the admin user‑management subsystem and is specific to this version. Any installation of Bagisto that has not applied the fix is susceptible.

The flaw provides a clear path to administrator privileges and therefore constitutes a high‑severity privilege escalation. While the EPSS score is currently not available, the lack of a KEV listing does not diminish the potential for exploitation. A malicious actor who can authenticate as a user with settings.users.edit permission can send a crafted role update request to the /admin/settings/users/update route, and the system will accept it without authorization checks, effectively granting full admin rights.