High severity8.8NVD Advisory· Published Oct 21, 2026· Updated Oct 21, 2026
CVE-2026-114387
CVE-2026-114387
Description
Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store() or Permissions::togglePermission() directly over /livewire/update to create admin accounts and escalate to full administrator.
Affected products
2(expand)+ 1 more
- (no CPE)
- (no CPE)range: <2.6.0
Patches
Vulnerability mechanics
References
6- github.com/shopperlabs/shopper/blob/v2.5.0/packages/admin/src/Livewire/Components/Settings/Team/Permissions.phpnvd
- github.com/shopperlabs/shopper/blob/v2.5.0/packages/admin/src/Livewire/SlideOvers/CreateTeamMember.phpnvd
- github.com/shopperlabs/shopper/commit/d1ac6cee2f02e5a84262fbeb87c689bd38df672fnvd
- github.com/shopperlabs/shopper/issues/433nvd
- github.com/shopperlabs/shopper/releases/tag/v2.6.0nvd
- www.vulncheck.com/advisories/shopper-2.0.0-before-2.6.0-privilege-escalation-via-unguarded-livewire-componentsnvd
News mentions
0No linked articles in our index yet.