CVE-2026-47745
CVE-2026-47745 · Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, the admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could disable every payment method on the store, disable or alter the default currency, or disable carriers. The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user. This vulnerability is fixed in 2.8.0.
CVSS 6.5 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
shopper
- Versions
- < 2.8.0: Affected
No fix published
shopper/framework Packagist
- Versions
- v2.0.0
- v2.0.0-alpha
- v2.0.0-beta
- v2.0.0-beta10
- v2.0.0-beta11
- v2.0.0-beta12
- v2.0.0-beta13
- v2.0.0-beta14
- v2.0.0-beta15
- v2.0.0-beta16
- v2.0.0-beta17
- v2.0.0-beta18
- v2.0.0-beta19
- v2.0.0-beta2
- v2.0.0-beta20
- v2.0.0-beta21
- v2.0.0-beta3
- v2.0.0-beta4
- v2.0.0-beta5
- v2.0.0-beta6
- v2.0.0-beta7
- v2.0.0-beta8
- v2.0.0-beta9
- v2.0.1
- v2.0.2
- v2.0.3
- v2.1.1
- v2.1.2
- v2.1.3
- v2.1.4
- v2.1.5
- v2.1.6
- v2.2
- v2.2.1
- v2.2.2
- v2.2.3
- v2.2.4
- v2.2.5
- v2.2.6
- v2.2.7
- v2.3
- v2.3.1
- v2.3.2
- v2.3.3
- v2.4.0
- v2.4.1
- v2.4.2
- v2.4.3
- v2.5.0
- v2.5.1
- v2.6.0
- v2.6.1
- v2.6.2
- v2.6.3
- v2.6.4
- v2.7.0
- v2.7.1
- v2.7.2
- v2.7.3
- Affected ranges
- ECOSYSTEM: < 2.8.0
Update to 2.8.0