CVE-2026-62991 Details
Description
Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route `/cpanel/customers/{user}/show` in `packages/admin/src/Livewire/Pages/Customers/Show.php` checks `read_customers` but looks up an arbitrary user ID without applying the `customers` role scope used by the listing. Authenticated staff holding `access_dashboard` and `read_customers` can change the user ID to retrieve administrator or staff profiles despite lacking `view_users`, which protects the separate team-management interface. The flaw exposes account profile data and permits user-ID enumeration through differing success, denial, and not-found responses. If the same role also holds `delete_customers`, `anonymizeAction()` operates on the unrestricted loaded user model and can enable destructive follow-up against non-customer accounts. This issue is fixed in version 2.10.1.
An Insecure Direct Object Reference (IDOR) vulnerability has been identified in the Shopper headless e-commerce admin panel, prior to version 2.10.1. The issue arises in the customer detail route, which fails to properly scope user ID lookups to the customer role. This allows authenticated staff with 'access_dashboard' and 'read_customers' permissions to access administrator or staff profiles by manipulating the user ID in the URL. The vulnerability bypasses the 'view_users' permission, exposing sensitive account information and enabling user ID enumeration through varied response messages. Additionally, if the user role includes 'delete_customers', the 'anonymizeAction()' function can be misused on non-customer accounts, potentially leading to data loss.
Users can update to Shopper version 2.10.1, where this vulnerability has been patched. The update applies the necessary role scoping to the customer detail route, ensuring that only customer accounts can be accessed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/shopperlabs/shopper/commit/14a28c5141574b0edb0f7ff261fbe449cd10b903 | [email protected] | Source CodeVendor |
| https://github.com/shopperlabs/shopper/pull/594 | [email protected] | Source CodeVendor |
| https://github.com/shopperlabs/shopper/releases/tag/v2.10.1 | [email protected] | Release NotesVendor |
| https://github.com/shopperlabs/shopper/security/advisories/GHSA-w7mm-g5pr-gpff | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Shopper | < 2.10.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |