Shopper, a headless e‑commerce admin panel, contains two authorization defects in its team settings that allow an authenticated user to seize control of the RBAC system. The Settings/Team/Index endpoint omits mount() authorization, enabling any authenticated user to load the page and use its public actions to create new roles and delete users, including administrators. Simultaneously, write actions on Settings/Team/RolePermission are only gated by the read‑only view_users permission, allowing any user with view_users to grant themselves or others arbitrary permissions such as manage_users or edit_orders, effectively elevating a low‑privileged account to full panel administrator. Together, these flaws let a non‑admin user acquire administrative rights and delete legitimate administrators, compromising the entire administrator control plane.

The product is Shopper by ShopperLabs. All Shopper releases prior to version 2.8.0 are affected; the advisory states that the vulnerability is fixed in 2.8.0, but no further patch level or build numbers are specified.

The vulnerability is rated CVSS 9.9, indicating critical severity. EPSS data is not available, and the issue is not listed in CISA KEV. The exploitation vector requires a valid authenticated session with low privileges; no external exploitation or elevated privileges are necessary beyond normal user access. Once compromised, the attacker can remove all existing administrators and retain full control, presenting a high risk of discovery and exploitation.