CVE-2026-56828— Shopper: read-only team permissions allow administrator creation and permission escalation

Quick assessment

Affected

shopperlabs shopper

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Shopper 是一个无头（Headless）电子商务管理后台。在版本 2.8.0 至 2.8.1 之间，三个 Shopper Livewire 管理组件在早期团队设置授权修复后仍存在授权漏洞。仅拥有和权限的普通员工即可修改权限、创建管理员或删除角色。具体漏洞细节如下：在中，和方法错误地仅校验了权限，而未要求更强的权限；同时，模板在处理器中暴露了权限 ID。攻击者可利用此漏洞为绑定角色授予任意权限（包括在自己的角色上授予权限），或删除权限定义。在中，和方法同样仅接受权限进行授权，且

CVSS 8.8 · High Updated Oct 28, 2026

Possible ATT&CK Techniques 3 AI

T1548.001 · Setuid and Setgid T1098 · Account Manipulation T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 1

Vendor	Product	Version Range	Status
shopperlabs	shopper	`>= 2.8.0, < 2.8.1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Shopper: read-only team permissions allow administrator creation and permission escalation

Source: CVE Program / CVE List V5

Vulnerability Description

Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain authorization gaps after the earlier team-settings authorization fix. A staff member with only `view_users` and `access_dashboard` can mutate permissions, create an administrator, or delete roles. In `packages/admin/src/Livewire/Components/Settings/Team/Permissions.php`, `togglePermission` and `removePermission` authorize `view_users` rather than the stronger `access_setting` permission; `packages/admin/resources/views/livewire/components/settings/team/permissions.blade.php` exposes permission IDs in `wire:click` handlers. The attacker can grant arbitrary permissions to the bound role, including `access_setting` on the attacker's own role, or delete permission definitions. In `packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php`, `mount()` and `store()` also accept `view_users`, and the client-selected `role_id` can identify the admin role, allowing creation of a pre-verified administrator with an attacker-chosen password. In `packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php`, `deleteAction` has no action authorization and is only conditioned on `can_be_removed`, while page access requires `view_users`. Deleting a removable role removes access for assigned users, enabling RBAC denial of service as well as privilege escalation. This issue is fixed in version 2.8.1.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
shopperlabs	shopper	>= 2.8.0, < 2.8.1	-

II. Public POCs for CVE-2026-56828

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-56828

请登录查看更多情报信息。

Other References for CVE-2026-56828 (5)

https://github.com/shopperlabs/shopper/pull/514 x_refsource_MISC
https://github.com/shopperlabs/shopper/releases/tag/v2.8.1 x_refsource_MISC
https://github.com/shopperlabs/shopper/compare/v2.8.1...v2.9.2 x_refsource_MISC
https://github.com/shopperlabs/shopper/security/advisories/GHSA-j328-xmgp-j4q3 x_refsource_CONFIRM
https://github.com/shopperlabs/shopper/commit/ac9a76044a8e4a2b570b438d66cf3007f3dc479e x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-56828

IV. Related Vulnerabilities

Same product: shopper

Same vendor: shopperlabs

Same weakness: CWE-285