Missing authorization in Shopper lets dashboard users create administrators
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
Shopper from 2.0.0 before 2.6.0 contains a missing authorization flaw (CWE-862) in its admin panel. Users holding only the access_dashboard permission can create administrators and grant permissions, because Livewire components do not check authorization. A remote attacker with low privileges can send requests directly to the affected component to create administrator accounts and gain full administrator access.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store() or Permissions::togglePermission() directly over /livewire/update to create admin accounts and escalate to full administrator.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| shopperlabs | shopper | 2.0.0 to before 2.6.0 | 2.6.0 | Patch available | CNA |
- shopper Vendorshopperlabs Affected 2.0.0 to before 2.6.0 Fixed in 2.6.0 Patch available CNA
Remediation
Shopper users should upgrade to version 2.6.0 or later, which fixes the flaw.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA shopper (shopperlabs) Fixed in 2.6.0
Timeline
- 2026-10-21 Threatist record created from CVE-2026-114387
- 2026-10-21 Alias added: GHSA-6wfw-fw32-2h84
- 2026-10-23 Priority changed: MEDIUM → LOW
- 2026-10-27 CISA SSVC decision points changed
- 2026-10-27 Priority changed: LOW → MEDIUM
References
Other 4
- https://github.com/shopperlabs/shopper/issues/433
- shopper v2.6.0 Release Notes
- https://github.com/shopperlabs/shopper/blob/v2.5.0/packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php#L102-L123
- https://github.com/shopperlabs/shopper/blob/v2.5.0/packages/admin/src/Livewire/Components/Settings/Team/Permissions.php#L18-L49
More shopperlabs vulnerabilities
- TI-2026-83413 Stored XSS via SVG and HTML uploads in Shopper admin panel CVSS 3.1HIGH 8.7
- TI-2026-40978 Missing authorization in shopperlabs shopper CVSS 3.1HIGH 8.1
- TI-2026-83412 Missing authorization in Shopper lets staff delete product variants CVSS 3.1HIGH 8.1
- TI-2026-40979 Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component CVSS 3.1HIGH 8.1
- TI-2026-40977 Shopper: Missing authorization on product removal actions in CollectionProducts component CVSS 3.1HIGH 8.1
- TI-2026-40981 Shopper: Negative discount values accepted and propagated through order calculation pipeline CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-114387 · CVE Program
- CVE-2026-114387 · NVD
- FIRST EPSS
- GHSA-6wfw-fw32-2h84 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences