GHSA-w7mm-g5pr-gpff: Shopper: customer detail IDOR exposes administrator and staff records
Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route /cpanel/customers/{user}/show in packages/admin/src/Livewire/Pages/Customers/Show.php checks readcustomers but looks up an arbitrary user ID without applying the customers role scope used by the listing. Authenticated staff holding accessdashboard and readcustomers can change the user ID to retrieve administrator or staff profiles despite lacking viewusers, which protects the separate team-management interface. The flaw exposes account profile data and permits user-ID enumeration through differing success, denial, and not-found responses. If the same role also holds deletecustomers, anonymizeAction() operates on the unrestricted loaded user model and can enable destructive follow-up against non-customer accounts. This issue is fixed in version 2.10.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Shopperto a version that resolves this vulnerability.Fixed in 2.10.1
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated staff user must have both access_dashboard and read_customers. They do not need the view_users permission that normally protects the team-management interface.
Is the exposure limited to customer records?
No. The affected detail route can retrieve administrator and staff profiles when a permitted staff user changes the user ID in the request. Response differences can also be used to enumerate user IDs.
Can this issue lead to changes or data loss?
If the same role also has delete_customers, the unrestricted user model used by anonymizeAction() can permit destructive follow-up actions against non-customer accounts. Otherwise, the described impact is exposure of account profile data.
What version fixes the issue?
Upgrade Shopper to version 2.10.1, which fixes the issue.