Authorization Defects in Shopper E-commerce Admin Panel

CVE-2026-47744

What is CVE-2026-47744?

The Shopper Admin Panel has two significant authorization flaws prior to version 2.8.0, which could be exploited by authenticated users. An unauthorized user could access the Settings/Team/Index page, which lacks proper mount() authorization, allowing them to create roles or delete other users, including administrators. Additionally, write actions on the role permissions are improperly gated, enabling users with view_users permission to grant themselves or others arbitrary powers such as manage_users or edit_orders. This vulnerability severely compromises the integrity of the RBAC system and can lead to unauthorized administrative access.

References