CVE-2026-47745 Details
Description
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, the admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could disable every payment method on the store, disable or alter the default currency, or disable carriers. The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user. This vulnerability is fixed in 2.8.0.
An authorization bypass vulnerability has been identified in Shopper, a headless e-commerce admin panel, in versions prior to 2.8.0. The vulnerability exists in the admin tables for PaymentMethods, Currencies, and Carriers, where inline toggles and per-record actions (enable, disable, edit, delete) were available to all authenticated users. This lack of proper authorization checks allowed low-privilege users to disable payment methods, alter default currencies, or disable carriers, leading to a complete denial of checkout and disruption of pricing integrity.
Users are advised to upgrade to Shopper version 2.8.0 or later, where this vulnerability has been fixed. Instructions for upgrading are available on the GitHub advisory page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 29, 2026CISA-ADP
Assessed May 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/shopperlabs/shopper/pull/511 | [email protected] | Issue TrackingVendor |
| https://github.com/shopperlabs/shopper/security/advisories/GHSA-fxqw-97cc-7g5c | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Shopper | < 2.8.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 29, 2026 | New CVE Received | [email protected] |