Vulnerability Description
Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store() or Permissions::togglePermission() directly over /livewire/update to create admin accounts and escalate to full administrator.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/shopperlabs/shopper/blob/v2.5.0/packages/admin/src/Livewire/C
- https://github.com/shopperlabs/shopper/blob/v2.5.0/packages/admin/src/Livewire/S
- https://github.com/shopperlabs/shopper/commit/d1ac6cee2f02e5a84262fbeb87c689bd38
- https://github.com/shopperlabs/shopper/issues/433
- https://github.com/shopperlabs/shopper/releases/tag/v2.6.0
- https://www.vulncheck.com/advisories/shopper-2.0.0-before-2.6.0-privilege-escala
FAQ
What is CVE-2026-114387?
CVE-2026-114387 is a vulnerability with a CVSS score of 8.8 (HIGH). Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard to create administrators and grant permissions. Attackers can...
How severe is CVE-2026-114387?
CVE-2026-114387 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-114387?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.