CVE-2026-62991— Shopper: customer detail IDOR exposes administrator and staff records

Quick assessment

Affected

shopperlabs shopper

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Shopper 是一个无头（Headless）电子商务管理面板。在版本 2.10.1 之前，中定义的客户详情路由虽然会检查权限，但在查找用户 ID 时并未应用客户列表页面所使用的角色作用域。因此，拥有和权限的已认证员工，可以通过修改用户 ID 来检索管理员或员工档案，尽管他们并不具备用于保护独立团队管理界面的权限。该漏洞会暴露账户档案数据，并允许通过不同的成功、拒绝及“未找到”响应进行用户 ID 枚举。若同一角色还持有权限，则方法会在无限制加载的用户模型上执行，从而可能对非客户账户实施破坏性后续操

CVSS 6.5 · Medium Updated Oct 31, 2026

Possible ATT&CK Techniques 3 AI

T1070 · Indicator Removal T1069 · Permission Groups Discovery T1203 · Exploitation for Client Execution

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Shopper: customer detail IDOR exposes administrator and staff records

Source: CVE Program / CVE List V5

Vulnerability Description

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route `/cpanel/customers/{user}/show` in `packages/admin/src/Livewire/Pages/Customers/Show.php` checks `read_customers` but looks up an arbitrary user ID without applying the `customers` role scope used by the listing. Authenticated staff holding `access_dashboard` and `read_customers` can change the user ID to retrieve administrator or staff profiles despite lacking `view_users`, which protects the separate team-management interface. The flaw exposes account profile data and permits user-ID enumeration through differing success, denial, and not-found responses. If the same role also holds `delete_customers`, `anonymizeAction()` operates on the unrestricted loaded user model and can enable destructive follow-up against non-customer accounts. This issue is fixed in version 2.10.1.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

通过用户控制密钥绕过授权机制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
shopperlabs	shopper	< 2.10.1	-

II. Public POCs for CVE-2026-62991

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-62991

请登录查看更多情报信息。

Other References for CVE-2026-62991 (4)

https://github.com/shopperlabs/shopper/pull/594 x_refsource_MISC
https://github.com/shopperlabs/shopper/releases/tag/v2.10.1 x_refsource_MISC
https://github.com/shopperlabs/shopper/security/advisories/GHSA-w7mm-g5pr-gpff x_refsource_CONFIRM
https://github.com/shopperlabs/shopper/commit/14a28c5141574b0edb0f7ff261fbe449cd10b903 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-62991

Same Patch Batch · shopperlabs · 2026-10-30 · 3 CVEs total

CVE-2026-62990	8.7 HIGH	Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator c
CVE-2026-62989	8.1 HIGH	Shopper: missing variant-delete authorization permits destructive single and bulk actions

IV. Related Vulnerabilities

Same product: shopper

Same vendor: shopperlabs

Same weakness: CWE-639