CVE-2026-47745
CVE-2026-47745 · Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, the admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could disable every payment method on the store, disable or alter the default currency, or disable carriers. The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user. This vulnerability is fixed in 2.8.0.
CVSS 6.5 · Media · EPSS 0,2% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: php
Productos y versiones afectados
shopper
- Versiones
- < 2.8.0: Afectada
Sin corrección publicada
shopper/framework Packagist
- Versiones
- v2.0.0
- v2.0.0-alpha
- v2.0.0-beta
- v2.0.0-beta10
- v2.0.0-beta11
- v2.0.0-beta12
- v2.0.0-beta13
- v2.0.0-beta14
- v2.0.0-beta15
- v2.0.0-beta16
- v2.0.0-beta17
- v2.0.0-beta18
- v2.0.0-beta19
- v2.0.0-beta2
- v2.0.0-beta20
- v2.0.0-beta21
- v2.0.0-beta3
- v2.0.0-beta4
- v2.0.0-beta5
- v2.0.0-beta6
- v2.0.0-beta7
- v2.0.0-beta8
- v2.0.0-beta9
- v2.0.1
- v2.0.2
- v2.0.3
- v2.1.1
- v2.1.2
- v2.1.3
- v2.1.4
- v2.1.5
- v2.1.6
- v2.2
- v2.2.1
- v2.2.2
- v2.2.3
- v2.2.4
- v2.2.5
- v2.2.6
- v2.2.7
- v2.3
- v2.3.1
- v2.3.2
- v2.3.3
- v2.4.0
- v2.4.1
- v2.4.2
- v2.4.3
- v2.5.0
- v2.5.1
- v2.6.0
- v2.6.1
- v2.6.2
- v2.6.3
- v2.6.4
- v2.7.0
- v2.7.1
- v2.7.2
- v2.7.3
- Intervalos de versiones afectados
- ECOSYSTEM: < 2.8.0
Actualiza a 2.8.0