Shopper, a headless e-commerce admin panel, contains an authorization bypass that lets an authenticated user with only read‑level permissions modify orders. Prior to version 2.8.0, users with the read_orders permission could trigger actions such as cancel, mark paid, mark complete, capture payment, archive, and start processing on the order detail view, while users with the browse_orders permission could mark shipments as delivered or edit tracking. The capturePayment action could move real funds through a payment service provider, allowing an attacker to alter order state and initiate payment capture without proper authorization. This flaw violates both the Authentication and Authorization control categories.

Shopper Labs' Shopper Headless e-commerce Admin Panel, any installed instance using a version older than 2.8.0. No specific vendor sub‑versions were listed in the advisories, but all releases before the 2.8.0 milestone are affected.

The CVSS score of 8.1 indicates a high‑severity flaw. The EPSS score is not available, and the vulnerability is not in the CISA KEV catalog, suggesting no known widespread exploitation yet. The likely attack vector is an internal exploitation of the admin interface, requiring only authenticated access with read‑only roles. Once the low‑privilege user sends a request to these endpoints, the system performs the requested state change and, in the case of capturePayment, executes an external transaction. The scope affects all orders within the panel, potentially compromising the entire e‑commerce lifecycle of the affected organization.