Authorization Vulnerabilities in Shopper Headless E-commerce Admin Panel

CVE-2026-56828

What is CVE-2026-56828?

The Shopper Headless e-commerce Admin Panel versions 2.8.0 and 2.8.1 contain significant authorization gaps that allow unauthorized personnel to escalate privileges. Staff members with minimal permissions, such as view_users and access_dashboard, can manipulate user roles, create administrative users, or remove existing roles. This occurs because critical functions like togglePermission and removePermission inadequately check permissions, enabling attackers to grant themselves access to sensitive settings or delete essential roles altogether. Additionally, functions handling team member creation can be exploited to set new admin passwords for attacker-defined users, while the lack of authorization checks in certain deletion functions results in a potential denial of service through role removal. Users are encouraged to upgrade to version 2.8.1 or later to mitigate these risks.

References