IT SBIT Services
Schneeberger
DEEN
CVE tracker

Shopper Admin Panel: Privilege escalation via missing authorization in team settings

CVE-2026-56828High 8.8

← All vulnerabilities

Summary

Shopper, a headless e-commerce admin panel, contains missing authorization checks in three Livewire admin components. A staff member with only the view_users and access_dashboard permissions can change role permissions, create a pre-verified administrator with a chosen password, or delete removable roles. Successful exploitation leads to full administrative control or locks out users assigned to deleted roles.

Affected

  • shopper/framework (Composer) from 2.8.0 up to 2.8.1 according to the CVE record
  • The advisory mirrors list the affected range up to but excluding 2.9.2
  • Unknown whether the 2.8.1 fix is complete

Fixed in

  • Fixed in 2.8.1 according to the CVE record and vendor release notes
  • Recommended target: 2.9.2 or later, because the advisory range extends past 2.8.1

Workaround

  • Patching is the fix; no vendor-published workaround is known.
  • If patching is not possible immediately, restrict admin panel access to trusted networks or VPN.
  • Review which accounts hold view_users or access_dashboard.

Exploitation

  • No evidence of exploitation in the wild; the CVE is not in CISA KEV.
  • Public proof-of-concept status is conflicting across sources; assume one may exist.
  • EPSS: 0.44 % (percentile 38).

Our recommendation

  • Identify all installations of shopper/framework and their versions.
  • Upgrade to 2.9.2 or later and clear the application cache afterwards.
  • Check the user and role tables for unexpected administrator accounts and changed permissions.
  • Limit admin panel access to VPN or trusted IP addresses until patched.
  • Review staff accounts with view_users or access_dashboard permissions and remove unneeded access.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:32.

Original description (NVD)

Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain authorization gaps after the earlier team-settings authorization fix. A staff member with only `view_users` and `access_dashboard` can mutate permissions, create an administrator, or delete roles. In `packages/admin/src/Livewire/Components/Settings/Team/Permissions.php`, `togglePermission` and `removePermission` authorize `view_users` rather than the stronger `access_setting` permission; `packages/admin/resources/views/livewire/components/settings/team/permissions.blade.php` exposes permission IDs in `wire:click` handlers. The attacker can grant arbitrary permissions to the bound role, including `access_setting` on the attacker's own role, or delete permission definitions. In `packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php`, `mount()` and `store()` also accept `view_users`, and the client-selected `role_id` can identify the admin role, allowing creation of a pre-verified administrator with an attacker-chosen password. In `packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php`, `deleteAction` has no action authorization and is only conditioned on `can_be_removed`, while page access requires `view_users`. Deleting a removable role removes access for assigned users, enabling RBAC denial of service as well as privilege escalation. This issue is fixed in version 2.8.1.

NVD references (5)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed