CVE-2026-114387
CVE-2026-114387 · Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Components
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store() or Permissions::togglePermission() directly over /livewire/update to create admin accounts and escalate to full administrator.
CVSS 8.7 · Alta · EPSS 0,3% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
shopper
- Versiones
- ≥ 2.0.0, < 2.6.0: Afectada (semver)
Actualiza a 2.6.0
Fuentes originales
- https://github.com/shopperlabs/shopper/issues/433
- https://github.com/shopperlabs/shopper/commit/d1ac6cee2f02e5a84262fbeb87c689bd38df672f
- https://github.com/shopperlabs/shopper/releases/tag/v2.6.0
- https://github.com/shopperlabs/shopper/blob/v2.5.0/packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php#L102-L123
- https://github.com/shopperlabs/shopper/blob/v2.5.0/packages/admin/src/Livewire/Components/Settings/Team/Permissions.php#L18-L49
- https://www.vulncheck.com/advisories/shopper-2.0.0-before-2.6.0-privilege-escalation-via-unguarded-livewire-components
- https://nvd.nist.gov/vuln/detail/CVE-2026-114387