CVE-2026-47744 Details

A critical vulnerability in Shopper's headless e-commerce admin panel, prior to version 2.8.0, allowed low-privilege authenticated users to escalate privileges to administrator level through two authorization flaws in the team settings. The first flaw involved the 'Settings/Team/Index' page, which lacked proper authorization, enabling any authenticated user to access the page and utilize its public actions to create new roles and delete users, including administrators. The second flaw was in 'Settings/Team/RolePermission', where write actions were improperly tied to the read-only 'view_users' permission. Users with 'view_users' could grant themselves or others arbitrary permissions, such as 'manage_users' and 'edit_orders', effectively allowing them to assume full administrative control from a read-only account. These vulnerabilities collectively permitted a low-privilege user to gain administrator rights and remove legitimate administrators from the panel.

Users are advised to upgrade to Shopper version 2.8.0, where this vulnerability has been fixed. The update can be applied using Composer with the command 'composer require shopper/admin:^2.8'.