CVE-2026-47740 Details

A vulnerability exists in Shopper, a headless e-commerce admin panel, prior to version 2.8.0. It allows authenticated low-privilege users to access multiple Filament actions in the admin Order detail and Order shipments table without the necessary permissions to modify orders. Specifically, actions such as canceling, marking orders as paid or complete, capturing payments, archiving, and starting processing could be performed with just the read-only 'read_orders' permission. The 'capturePayment' action could trigger an actual payment service provider capture, moving real funds. Similarly, actions on the order shipments table, like marking deliveries and editing tracking, were accessible with the 'browse_orders' permission. This vulnerability enabled users with read access to orders to manipulate the order lifecycle and initiate real-world payment captures.

Users are advised to upgrade to Shopper version 2.8.0, where this vulnerability has been fixed. Instructions for upgrading are available on the GitHub advisory page.