CVE-2026-114387 Details
Description
Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store() or Permissions::togglePermission() directly over /livewire/update to create admin accounts and escalate to full administrator.
A missing authorization vulnerability has been identified in Shopper versions 2.0.0 prior to 2.6.0. This vulnerability allows users with admin-panel access and only the 'access_dashboard' permission to create new administrators and assign permissions. The issue arises because approximately 25 Livewire components lack proper server-side authorization checks, relying instead on UI-level directives. As a result, users can invoke critical functions directly over the '/livewire/update' route to escalate their privileges.
Users can update to Shopper version 2.6.0 or later, where this vulnerability has been addressed by adding the necessary authorization checks to all affected Livewire components.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Shopper | >= 2.0.0, < 2.6.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 27, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |