CVE-2026-114387: Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Components
Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only accessdashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store() or Permissions::togglePermission() directly over /livewire/update to create admin accounts and escalate to full administrator.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Shopperto a version that resolves this vulnerability.Fixed in 2.6.0
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An authenticated admin-panel user who has only the access_dashboard permission can exploit it. The issue does not require user interaction and can be reached over the network through the /livewire/update endpoint.
What can a successful attacker do?
The attacker can directly invoke CreateTeamMember::store() to create administrator accounts or Permissions::togglePermission() to grant permissions. This enables escalation from dashboard-only access to full administrator privileges.
Which versions are affected and what fixes the issue?
Shopper versions from 2.0.0 before 2.6.0 are affected. Upgrading to version 2.6.0 addresses the vulnerability.