Shopper CVE-2026-114387

Requires a valid authenticated admin-panel account that holds only the access_dashboard permission (a low-privilege staff/back-office login); it is not exploitable by anonymous internet users. The affected Shopper versions 2.0.0 through 2.5.x expose the CreateTeamMember and Permissions Livewire components without server-side authorization checks, so the account can directly invoke CreateTeamMember::store() or Permissions::togglePermission() via the /livewire/update endpoint. Limiting factors: a low-tier authenticated session is mandatory (insider or compromised credential), no user interaction is needed, and upgrading to 2.6.0 (which adds the authorize() guards) fully remediates it.

This is a genuine, actionable privilege-escalation issue rather than an inflated high-CVSS score, though it is not an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows low-complexity, network-reachable exploitation requiring only low privileges - specifically an authenticated admin-panel account holding only the access_dashboard permission - with high impact to confidentiality, integrity and availability (VC:H/VI:H/VA:H). The source-code evidence strongly corroborates the root cause: the patch adds $this->authorize(...) guards to the mount() and togglePermission() methods of previously unguarded Livewire components (Permissions.php, CreateTeamMember, and numerous Settings pages), confirming CWE-862 missing authorization. Signals are mildly conflicting on urgency: there is NO CISA KEV listing and NO public exploit/POC referenced, and EPSS is not provided, which suggests no evidence of widespread automated exploitation; however, the VulnCheck advisory and the public commit diff together provide a near step-by-step roadmap (call CreateTeamMember::store() or Permissions::togglePermission() over /livewire/update), lowering the practical barrier to weaponization. Net: prioritize patching for any Shopper deployment that grants limited (access_dashboard-only) staff accounts, since any such insider or compromised low-tier account can reach full administrator, but treat it as a standard high-severity patch cycle item absent evidence of active exploitation.

A low-privilege back-office staff member (or an attacker who has phished/compromised such an account holding only access_dashboard) sends a crafted POST to the /livewire/update endpoint directly invoking the unguarded CreateTeamMember::store() or Permissions::togglePermission() methods. Because no authorization check runs server-side, the request creates a new administrator account or toggles permissions, escalating the actor to full administrator. No separate public exploit tool is published, but the vendor advisory and patch diff disclose the exact vulnerable methods and endpoint.