Privilege Escalation Vulnerability in Shopper by Shopperlabs
CVE-2026-114387

8.7HIGH

Key Information:

Vendor

Shopperlabs

Status
Shopper
Vendor
CVE Published:
21 October 2026

What is CVE-2026-114387?

A missing authorization flaw exists in versions 2.0.0 through 2.5.0 of Shopper, allowing users with limited access to the admin panel to create additional admin accounts and alter their permissions. Attackers can exploit this weakness by directly invoking methods on Livewire components, leading to unauthorized escalation of privileges, which could compromise the integrity of the system. It is critical for users running affected versions to update to version 2.6.0 or later to mitigate this vulnerability.

Affected Version(s)

shopper 2.0.0 < 2.6.0

References

https://github.com/shopperlabs/shopper/issues/433
issue-tracking
https://github.com/shopperlabs/shopper/commit/d1ac6cee2f0...
patch
https://github.com/shopperlabs/shopper/releases/tag/v2.6.0
release-notes

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lighthousekeeper1212
leediay153 from Viettel Post
.