EUVD-2026-33407
GHSA-c3qp-2ggw-xjg7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionGitHub Advisory
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, two distinct authorization defects in the team settings allowed any authenticated panel user to take over the RBAC system. Settings/Team/Index had no mount() authorization. Any authenticated user could load the page and use its public actions to create new roles and delete other users, including administrators. Settings/Team/RolePermission gated its write actions on the read-only view_users permission. Any user holding view_users could grant themselves or any other user arbitrary permissions, including manage_users and edit_orders, effectively escalating to full panel administrator from a read-only account. Combined, these two defects allow a low-privilege authenticated user to obtain administrator privileges and remove the legitimate administrators from the panel. This vulnerability is fixed in 2.8.0.
AnalysisAI
Privilege escalation in Shopper headless e-commerce admin panel prior to version 2.8.0 allows any low-privilege authenticated panel user to seize full administrator control by chaining two distinct broken-authorization defects in the team settings module. By combining an unprotected Settings/Team/Index mount with a RolePermission write path that only checks the read-only view_users permission, an attacker can mint new roles, grant themselves manage_users and edit_orders, and delete legitimate administrators. No public exploit identified at time of analysis, but the bugs are straightforward to weaponize once panel credentials are obtained.
Technical ContextAI
Shopper (cpe:2.3:a:shopperlabs:shopper) is a Laravel-based headless e-commerce admin panel that ships an RBAC subsystem governing user, role, and permission management through Livewire/Filament-style component actions. The root cause maps to CWE-269 (Improper Privilege Management) and manifests in two adjacent components: Settings/Team/Index never invokes a mount()-time authorization gate, so its public component actions (role creation, user deletion) are reachable by any signed-in session; and Settings/Team/RolePermission conflates read and write authorization, gating mutating actions on view_users - a permission designed only to allow visibility into the user list. The defect is a classic horizontal/vertical access-control failure where the framework's per-action policy checks were either omitted or scoped to the wrong permission constant.
RemediationAI
Vendor-released patch: upgrade Shopper to version 2.8.0 or later, as documented in the GitHub Security Advisory at https://github.com/shopperlabs/shopper/security/advisories/GHSA-c3qp-2ggw-xjg7. If immediate upgrade is not possible, compensating controls include restricting the /settings/team route at the web server or reverse-proxy layer to a hard-coded allowlist of administrator IPs (side effect: legitimate non-admin staff lose team-page visibility), revoking the view_users permission from every non-admin role until the upgrade lands (side effect: read-only auditors can no longer enumerate users), and auditing the roles and permissions tables for unexpected manage_users or edit_orders grants and recently created roles to detect prior exploitation. Re-verify the administrator account list after patching, since the bug allows deletion of legitimate admins.
Authorization bypass in Shopperlabs Shopper headless e-commerce admin panel prior to 2.8.0 allows authenticated low-priv
Privilege escalation in shopperlabs/shopper prior to 2.8.0 allows any authenticated admin panel user - regardless of ass
Missing authorization enforcement in the Shopper headless e-commerce admin panel (all versions prior to 2.8.0) allows an
Discount over-redemption via race condition in Shopper (shopperlabs/shopper prior to v2.8.0) allows concurrent unauthent
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today