Arbitrary User ID Exposure in Shopper E-commerce Admin Panel

CVE-2026-62991

What is CVE-2026-62991?

Shopper, a Headless e-commerce Admin Panel, contains a vulnerability that allows authenticated staff with certain permissions to manipulate the customer detail route and access unauthorized user profiles. Specifically, prior to version 2.10.1, the system failed to enforce proper role scoping when retrieving user details, potentially exposing sensitive account information. This vulnerability enables not only the enumeration of user IDs but also risks destructive actions against non-customer accounts, especially if the user likewise possesses deletion rights. The issue has been addressed in the latest release, version 2.10.1.

References