EUVD-2026-33407
GHSA-c3qp-2ggw-xjg7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain low-privilege panel credentials
-
DeliveryAuthenticate to Shopper admin panel
-
ExploitLoad Settings/Team/RolePermission component
-
InstallGrant self manage_users via view_users gate
-
C2Invoke Settings/Team/Index unprotected actions
-
ExecuteDelete legitimate administrator accounts
-
ImpactOperate panel as sole administrator
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated session on the Shopper admin panel at any privilege tier - a brand-new read-only account is sufficient because Settings/Team/Index has no mount() authorization at all, and the RolePermission write path only checks view_users which is itself a read-tier permission. Exploitation is limited to Shopper installations prior to 2.8.0 where the attacker can reach the /settings/team routes (i.e., the admin panel must be network-reachable from the attacker), and presupposes the attacker has obtained or been issued panel credentials; it does not require any non-default configuration, plugin, or user interaction from an existing admin. |
| Impact | The CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) score is well-supported by the description: exploitation is network-reachable against the admin panel, requires only low privileges (any authenticated panel account, including a read-only one), needs no user interaction, and changes the security scope by elevating to full admin. EPSS and CISA KEV status were not provided in the input, so probabilistic exploitation likelihood and confirmed in-the-wild activity cannot be asserted; no public exploit identified at time of analysis. Real-world priority is high for any deployment where panel accounts are issued broadly (staff, contractors, vendors) because a single low-trust credential pivots to total panel takeover and denial of access to legitimate admins - however, the prerequisite of an authenticated panel session means internet-exposed but credentialed-only attack surface limits drive-by mass exploitation versus insider/credential-theft scenarios. |
| Exploit ScenarioDerived | A disgruntled customer-support contractor with a read-only Shopper panel account logs in, navigates to Settings/Team/RolePermission, and uses their view_users permission to grant their own user the manage_users and edit_orders permissions. They then load Settings/Team/Index, delete the two legitimate administrator accounts, lock out the business owner, and modify pending orders or exfiltrate customer data before detection. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 29, 2026
Privilege escalation in Shopper headless e-commerce admin panel prior to version 2.8.0 allows any low-privilege authenticated panel user to seize full administrator control by chaining two distinct broken-authorization defects in the team settings module. By combining an unprotected Settings/Team/Index mount with a RolePermission write path that only checks the read-only view_users permission, an attacker can mint new roles, grant themselves manage_users and edit_orders, and delete legitimate administrators. No public exploit identified at time of analysis, but the bugs are straightforward to weaponize once panel credentials are obtained.
RemediationAI
Vendor-released patch: upgrade Shopper to version 2.8.0 or later, as documented in the GitHub Security Advisory at https://github.com/shopperlabs/shopper/security/advisories/GHSA-c3qp-2ggw-xjg7. If immediate upgrade is not possible, compensating controls include restricting the /settings/team route at the web server or reverse-proxy layer to a hard-coded allowlist of administrator IPs (side effect: legitimate non-admin staff lose team-page visibility), revoking the view_users permission from every non-admin role until the upgrade lands (side effect: read-only auditors can no longer enumerate users), and auditing the roles and permissions tables for unexpected manage_users or edit_orders grants and recently created roles to detect prior exploitation. Re-verify the administrator account list after patching, since the bug allows deletion of legitimate admins.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Shopper (cpe:2.3:a:shopperlabs:shopper) is a Laravel-based headless e-commerce admin panel that ships an RBAC subsystem governing user, role, and permission management through Livewire/Filament-style component actions. The root cause maps to CWE-269 (Improper Privilege Management) and manifests in two adjacent components: Settings/Team/Index never invokes a mount()-time authorization gate, so its public component actions (role creation, user deletion) are reachable by any signed-in session; and Settings/Team/RolePermission conflates read and write authorization, gating mutating actions on view_users - a permission designed only to allow visibility into the user list. The defect is a classic horizontal/vertical access-control failure where the framework's per-action policy checks were either omitted or scoped to the wrong permission constant.
Know when Shopper gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, two distinct authorization defects in the team settings allowed any authenticated panel user to take over the RBAC system. Settings/Team/Index had no mount() authorization. Any authenticated user could load the page and use its public actions to create new roles and delete other users, including administrators. Settings/Team/RolePermission gated its write actions on the read-only view_users permission. Any user holding view_users could grant themselves or any other user arbitrary permissions, including manage_users and edit_orders, effectively escalating to full panel administrator from a read-only account. Combined, these two defects allow a low-privilege authenticated user to obtain administrator privileges and remove the legitimate administrators from the panel. This vulnerability is fixed in 2.8.0.
Executive ViewAI
Shopper headless e-commerce admin panel versions prior to 2.8.0 contain a critical privilege escalation vulnerability allowing authenticated panel users to escalate to full administrator access by exploiting broken authorization controls in the team settings module. Organizations using affected versions face immediate risk of unauthorized administrative actions, including user deletion and order manipulation. The vulnerability requires existing panel credentials but poses complete loss of administrative access control.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement network-level access controls limiting admin panel to specific IP ranges; (2) Remove or suspend low-privilege admin accounts not actively required; (3) Enable continuous logging and alerting on role permission modifications and admin account changes; (4) Establish weekly administrative access reviews; (5) Implement multi-factor authentication for all panel users.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Privilege escalation in Shopper 2.0.0 through 2.5.x allows an authenticated admin-panel user who holds only the access_d
Stored cross-site scripting in the Shopper headless e-commerce admin panel (2.0.0 up to but not including 2.10.1, plus 3
Authorization bypass in Shopperlabs Shopper headless e-commerce admin panel prior to 2.8.0 allows authenticated low-priv
Permanent deletion of product variants in Shopper's admin panel is possible for any authenticated staff member who holds
Privilege escalation in shopperlabs/shopper prior to 2.8.0 allows any authenticated admin panel user - regardless of ass
Missing authorization enforcement in the Shopper headless e-commerce admin panel (all versions prior to 2.8.0) allows an
Shopper versions prior to 2.10.1 expose administrator and staff profile records to low-privileged admin-panel users thro
Discount over-redemption via race condition in Shopper (shopperlabs/shopper prior to v2.8.0) allows concurrent unauthent
Exploit-DB