A missing authorization check in Shopper’s Livewire components allows users who possess only the access_dashboard permission within the admin panel to create new administrators or grant administrative privileges by calling the CreateTeamMember::store() or Permissions::togglePermission() functions directly via the /livewire/update endpoint. The lack of proper access control enables an attacker to assume full administrative control over the application, enabling unrestricted viewing, editing, and deletion of store data.

Shopper Labs’ Shopper application from version 2.0.0 up to any pre‑2.6.0 release, typically 2.5.x, is affected. The vendor released version 2.6.0 with the missing authorization guards fixed; installations that have not been upgraded to 2.6.0 or later remain vulnerable.

The vulnerability scores a CVSS of 8.7, indicating high severity, and no EPSS score or KEV listing is available. Attackers can exploit the vulnerability by authenticated web requests to the /livewire/update URL, requiring only the access_dashboard role, which is commonly granted to standard administrative users. This internal or procured attacker scenario carries significant risk for privilege escalation and should be addressed promptly.