Description
Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain authorization gaps after the earlier team-settings authorization fix. A staff member with only `view_users` and `access_dashboard` can mutate permissions, create an administrator, or delete roles. In `packages/admin/src/Livewire/Components/Settings/Team/Permissions.php`, `togglePermission` and `removePermission` authorize `view_users` rather than the stronger `access_setting` permission; `packages/admin/resources/views/livewire/components/settings/team/permissions.blade.php` exposes permission IDs in `wire:click` handlers. The attacker can grant arbitrary permissions to the bound role, including `access_setting` on the attacker's own role, or delete permission definitions. In `packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php`, `mount()` and `store()` also accept `view_users`, and the client-selected `role_id` can identify the admin role, allowing creation of a pre-verified administrator with an attacker-chosen password. In `packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php`, `deleteAction` has no action authorization and is only conditioned on `can_be_removed`, while page access requires `view_users`. Deleting a removable role removes access for assigned users, enabling RBAC denial of service as well as privilege escalation. This issue is fixed in version 2.8.1.
Published: 2026-10-28
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

An authorization shortcut in Shopper's Livewire components lets a user who only has read‑only team permissions mutate permissions and create or delete administrators. The flaw permits granting a staff member the full access_setting permission on their own role, bypassing stricter checks. This vulnerability enables an attacker with minimal duties to elevate privileges, set an attacker‑chosen administrator account, or remove roles, thereby causing denial of service for users under those roles.

Affected Systems

Shopper Labs’ headless e‑commerce admin panel is affected by this issue. It exists in releases 2.8.0 through 2.8.1 and was fixed in version 2.8.1. No later releases are reported as affected.

Risk and Exploitability

The CVSS score of 8.8 reflects a high severity. EPSS information is not available and the flaw is not listed in the KEV catalog. An attacker can exploit the bug via the web administration interface using only view_users and access_dashboard permissions; no external network access is required. The vulnerability allows privilege escalation and denial of service, making it attractive for adversaries who can manually exercise the described actions.

Generated by OpenCVE AI on October 28, 2026 at 16:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Shopper to version 2.8.1 or later to eliminate the authorization flaw.
  • Restrict any account with only view_users and access_dashboard permissions from accessing team permissions or role creation features until the patch is applied.
  • Audit existing users and roles for unauthorized administrator accounts or missing role-based access controls, and rebuild role definitions if necessary.

Generated by OpenCVE AI on October 28, 2026 at 16:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-j328-xmgp-j4q3 Shopper: privilege escalation via improper Livewire admin component authorization
History

Wed, 28 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Shopperlabs
Shopperlabs shopper
Vendors & Products Shopperlabs
Shopperlabs shopper

Wed, 28 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
Description Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain authorization gaps after the earlier team-settings authorization fix. A staff member with only `view_users` and `access_dashboard` can mutate permissions, create an administrator, or delete roles. In `packages/admin/src/Livewire/Components/Settings/Team/Permissions.php`, `togglePermission` and `removePermission` authorize `view_users` rather than the stronger `access_setting` permission; `packages/admin/resources/views/livewire/components/settings/team/permissions.blade.php` exposes permission IDs in `wire:click` handlers. The attacker can grant arbitrary permissions to the bound role, including `access_setting` on the attacker's own role, or delete permission definitions. In `packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php`, `mount()` and `store()` also accept `view_users`, and the client-selected `role_id` can identify the admin role, allowing creation of a pre-verified administrator with an attacker-chosen password. In `packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php`, `deleteAction` has no action authorization and is only conditioned on `can_be_removed`, while page access requires `view_users`. Deleting a removable role removes access for assigned users, enabling RBAC denial of service as well as privilege escalation. This issue is fixed in version 2.8.1.
Title Shopper: read-only team permissions allow administrator creation and permission escalation
Weaknesses CWE-285
CWE-862
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Shopperlabs Shopper
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-28T15:40:39.294Z

Reserved: 2026-06-23T14:55:09.117Z

Link: CVE-2026-56828

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-28T16:17:08.220

Modified: 2026-10-28T16:17:08.360

Link: CVE-2026-56828

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T16:30:15Z

Weaknesses