CVE-2026-62991: Shopper: customer detail IDOR exposes administrator and staff records
Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route /cpanel/customers/{user}/show in packages/admin/src/Livewire/Pages/Customers/Show.php checks readcustomers but looks up an arbitrary user ID without applying the customers role scope used by the listing. Authenticated staff holding accessdashboard and readcustomers can change the user ID to retrieve administrator or staff profiles despite lacking viewusers, which protects the separate team-management interface. The flaw exposes account profile data and permits user-ID enumeration through differing success, denial, and not-found responses. If the same role also holds deletecustomers, anonymizeAction() operates on the unrestricted loaded user model and can enable destructive follow-up against non-customer accounts. This issue is fixed in version 2.10.1.
Event History
Frequently Asked Questions
Which users can exploit this issue?
Authenticated staff accounts that have both access_dashboard and read_customers can request arbitrary user IDs on the customer-detail route. They do not need the view_users permission that normally protects the team-management interface.
What information or actions are exposed?
Affected users can retrieve administrator and staff profile data and enumerate user IDs based on differing success, denial, and not-found responses. If the same role also has delete_customers, it may anonymize non-customer accounts through the unrestricted loaded user model.
Are deployments affected by default?
Exposure depends on assigned staff permissions. The issue requires a role with access_dashboard and read_customers; destructive follow-up additionally requires delete_customers.
How can I tell whether my deployment is vulnerable?
Versions prior to 2.10.1 are affected. Review staff roles for access_dashboard and read_customers, then determine whether those users can alter the ID in /cpanel/customers/{user}/show to access non-customer accounts.
What can be done before upgrading?
Restrict access_dashboard or read_customers for staff who do not require customer-detail access. Also remove delete_customers from any potentially exposed roles to prevent the described anonymization follow-up.