Shopper contains an IDOR in the customer detail route that allows a staff user with the read_customers permission to view any user profile, including administrators and other staff. The implementation checks the read_customers capability but fails to constrain the loaded user to the current customers’ scope, so an attacker can supply arbitrary numeric IDs. Successful requests return profile data while failures produce distinct HTTP responses, enabling enumeration of valid user IDs. When a user also holds delete_customers, the anonymizeAction() method can act on the unscoped model, allowing destructive changes to non-customer accounts. This flaw directly exposes sensitive account data and, if exploit conditions are present, may lead to data deletion or other tampering.

The vulnerability affects Shopper, a headless e-commerce admin panel from ShopperLabs, in all releases prior to version 2.10.1. No specific sub-product variants are listed, and the issue is not limited to a particular operating system or environment.

The assessed CVSS score is 6.5, indicating a moderate impact. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The flaw requires an authenticated user that holds the access_dashboard and read_customers permissions; in practice an attacker would leverage compromised staff credentials or a phishing campaign. Because the endpoint responds differently to valid, invalid, and nonexistent IDs, victim accounts can be enumerated. Additionally, accounts that possess delete_customers can exploit the mis-scoped anonymizeAction(), enabling destructive operations against non-customer users. Given the credentials required and the availability of an official patch, the risk is moderate but should be addressed promptly.