TI-2026-83414 Aliases CVE-2026-62991

Authorization bypass in Shopper exposes staff and admin records

LOW 28CWE-639Published 2026-10-30 · Updated 2026-11-02

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

shopperlabs Shopper before 2.10.1 contains an authorization bypass through a user-controlled key (CWE-639) in its customer detail route. The route looks up any user ID without applying the customers role scope used by the listing. An authenticated staff user with access_dashboard and read_customers can view administrator and staff profiles that the team-management interface protects, and can enumerate user IDs from differing responses. If the same role also holds delete_customers, the anonymize action can act on non-customer accounts.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route `/cpanel/customers/{user}/show` in `packages/admin/src/Livewire/Pages/Customers/Show.php` checks `read_customers` but looks up an arbitrary user ID without applying the `customers` role scope used by the listing. Authenticated staff holding `access_dashboard` and `read_customers` can change the user ID to retrieve administrator or staff profiles despite lacking `view_users`, which protects the separate team-management interface. The flaw exposes account profile data and permits user-ID enumeration through differing success, denial, and not-found responses. If the same role also holds `delete_customers`, `anonymizeAction()` operates on the unrestricted loaded user model and can enable destructive follow-up against non-customer accounts. This issue is fixed in version 2.10.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00238 14th percentileScored 2026-11-07

Fix Fixed shopper (shopperlabs): 2.10.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
shopperlabs	shopper	before 2.10.1	2.10.1	Patch available	CNA

shopper Vendorshopperlabs Affected before 2.10.1 Fixed in 2.10.1 Patch available CNA

Remediation

Upgrade shopperlabs Shopper to version 2.10.1, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Fix · CNA shopper (shopperlabs) Fixed in 2.10.1

Timeline

2026-10-30 Threatist record created from CVE-2026-62991
2026-11-01 Priority changed: MEDIUM → LOW
2026-11-02 CISA SSVC decision points changed

References

Other 4

TI-2026-83413 Stored XSS via SVG and HTML uploads in Shopper admin panel CVSS 3.1HIGH 8.7
TI-2026-40978 Missing authorization in shopperlabs shopper CVSS 3.1HIGH 8.1
TI-2026-83412 Missing authorization in Shopper lets staff delete product variants CVSS 3.1HIGH 8.1
TI-2026-40979 Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component CVSS 3.1HIGH 8.1
TI-2026-40977 Shopper: Missing authorization on product removal actions in CollectionProducts component CVSS 3.1HIGH 8.1
TI-2026-40981 Shopper: Negative discount values accepted and propagated through order calculation pipeline CVSS 3.1MEDIUM 6.5

See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences