# CVE-2026-114387: Shopper privilege escalation via missing authorization in admin panel

Source: https://junglewise.ai/threats/cve-2026-114387-shopper-from-2-0-0-before-2-6-0-contains-a-missing-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-114387 · Severity: high · CVSS 8.8 · Published 2026-10-21

Shopper is an e-commerce admin panel that manages users and permissions. A vulnerability allows low-privilege dashboard users to escalate their access to full administrator by directly calling internal functions through the Livewire update endpoint. An attacker with limited access can create new admin accounts and grant themselves any permission.

Technologies: [Shopper Labs Shopper](https://junglewise.ai/threats/technologies/shopper). Vendors: [Shopper Labs](https://junglewise.ai/threats/vendors/shopper-labs).

## Quick answers

**Is CVE-2026-114387 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114387 being exploited in the wild.

**How severe is CVE-2026-114387?** High severity, with a CVSS score of 8.8, published 21 October 2026.

**Which products and versions are affected?** Shopper Labs Shopper 2.0.0 to before 2.6.0.

**Is there a fix for CVE-2026-114387?** Yes: fixed in 2.6.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114387 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-114387?** Check whether you run Shopper Labs Shopper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.6.0

## Technical details

The vulnerability is a missing authorization check in the Permissions::togglePermission() and CreateTeamMember::store() Livewire components. Authenticated users with only access_dashboard permission can directly invoke these methods via /livewire/update without authorization validation, allowing role escalation and admin account creation. The fix is included in version 2.6.0.

## Affected products

- Shopper Labs Shopper 2.0.0 to before 2.6.0

## Timeline

- 2026-10-21: disclosed

## References

- [https://github.com/shopperlabs/shopper/blob/v2.5.0/packages/admin/src/Livewire/Components/Settings/Team/Permissions.php](https://github.com/shopperlabs/shopper/blob/v2.5.0/packages/admin/src/Livewire/Components/Settings/Team/Permissions.php)
- [https://github.com/shopperlabs/shopper/blob/v2.5.0/packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php](https://github.com/shopperlabs/shopper/blob/v2.5.0/packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php)

## Related threats

- [Shopper authorization bypass in customer detail route](https://junglewise.ai/threats/cve-2026-62991-shopper-is-a-headless-e-commerce-admin-panel-prior-to-2-10-1-the)
- [Shopper authorization bypass in variant deletion](https://junglewise.ai/threats/cve-2026-62989-shopper-is-a-headless-e-commerce-admin-panel-prior-to-2-10-0-the)
- [Shopper VariantStock missing authorization and unlocked property](https://junglewise.ai/threats/cve-2026-56829-shopper-variantstock-missing-authorization-and-unlocked-property)
- [Shopper authorization bypass in Filament bulk actions](https://junglewise.ai/threats/cve-2026-56827-shopper-authorization-bypass-in-filament-bulk-actions)
- [Shopper CollectionProducts missing authorization on product removal](https://junglewise.ai/threats/cve-2026-56825-shopper-collectionproducts-missing-authorization-on-product)