Shopper: Missing authorization allows privilege escalation to administrator
Summary
Shopper 2.0.0 up to before 2.6.0 lacks an authorization check in its team and permission Livewire components. An admin-panel user who holds only the access_dashboard permission can create administrator accounts and grant permissions, for example by calling the component methods directly over /livewire/update. This leads to full administrator control of the shop, including customer and payment-related data. The attacker needs a valid admin-panel login, so the risk is mainly relevant where staff, contractors or compromised accounts have admin-panel access.
Affected
- Shopper 2.0.0 up to but not including 2.6.0
- Versions 2.6.0 and later are not affected by this CVE
Fixed in
- Shopper 2.6.0 (per the CVE record, VulnCheck and VulDB; verify against the GitHub release notes)
Workaround
- No vendor workaround found.
- Restrict which users hold the access_dashboard permission.
- Limit access to the admin panel to trusted networks or VPN.
Exploitation
- No public proof of concept found.
- One aggregator reports exploitation attempts; this is unverified.
- Not listed as known exploited by a third-party tracker; CISA KEV not checked directly.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Check whether Shopper is deployed and which version is in the Composer lock file (shopper/framework).
- Upgrade to 2.6.0 at minimum, preferably to the newest release, which also covers CVE-2026-56826 and CVE-2026-56828.
- Review admin and team accounts for unexpected additions and permission changes since 21 Oct 2026.
- Restrict admin-panel access by network, VPN or MFA where possible.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-114387 VulnCheck advisory www.vulncheck.com
- Shopper release v2.6.0 github.com
- Shopper fix commit d1ac6cee github.com
- Permissions.php at v2.5.0 github.com
- CreateTeamMember.php at v2.5.0 github.com
- VulDB entry 424787 vuldb.com
- CVE-2026-56826 GitLab advisory advisories.gitlab.com
- CVE-2026-56828 Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:02.
Original description (NVD)
Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store() or Permissions::togglePermission() directly over /livewire/update to create admin accounts and escalate to full administrator.
NVD references (6)
- https://github.com/shopperlabs/shopper/blob/v2.5.0/packages/admin/src/Livewire/Components/Settings/Team/Permi…
- https://github.com/shopperlabs/shopper/blob/v2.5.0/packages/admin/src/Livewire/SlideOvers/CreateTeamMember.ph…
- https://github.com/shopperlabs/shopper/commit/d1ac6cee2f02e5a84262fbeb87c689bd38df672f
- https://github.com/shopperlabs/shopper/issues/433
- https://github.com/shopperlabs/shopper/releases/tag/v2.6.0
- https://www.vulncheck.com/advisories/shopper-2.0.0-before-2.6.0-privilege-escalation-via-unguarded-livewire-c…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.