Vulnerability in Headless E-commerce Admin Panel by Shopper Exposes Permissions to Authenticated Users
CVE-2026-47745

6.5MEDIUM

Key Information:

Vendor

Shopperlabs

Status
Shopper
Vendor
CVE Published:
29 May 2026

What is CVE-2026-47745?

In versions prior to 2.8.0 of Shopper's Headless e-commerce Admin Panel, there is a significant security flaw whereby inline toggles and actions related to PaymentMethods, Currencies, and Carriers were accessible to any authenticated user without appropriate permission checks. This weakness allows low-privilege users to disable vital components like payment methods and the default currency, which can lead to severe operational disruptions and affect pricing integrity. The vulnerability was addressed in version 2.8.0, enhancing the security architecture to prevent such unauthorized actions.

Affected Version(s)

shopper < 2.8.0

References

https://github.com/shopperlabs/shopper/security/advisorie...
x_refsource_CONFIRM
https://github.com/shopperlabs/shopper/pull/511
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.