# CVE-2026-47740: Shopper Missing Authorization in Order and Shipment Actions

Source: https://junglewise.ai/threats/cve-2026-47740-shopper-missing-authorization-in-order-and-shipment-actions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-47740 · Severity: high · CVSS 8.1 · Published 2026-05-29

Shopper is a headless e-commerce administration panel used to manage online stores. A security flaw allowed staff members with limited 'read-only' access to perform restricted actions, such as canceling orders, marking them as complete, or even triggering actual payment captures from customers. This could lead to unauthorized financial transactions and disruption of business operations by low-privileged internal users.

Technologies: [shopper/framework (Packagist)](https://junglewise.ai/threats/technologies/shopper-framework). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-47740 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47740 being exploited in the wild.

**How severe is CVE-2026-47740?** High severity, with a CVSS score of 8.1, published 29 May 2026.

**Which products and versions are affected?** shopper/framework (Packagist) ECOSYSTEM:introduced=0,fixed=2.8.0.

**Is there a fix for CVE-2026-47740?** Yes. shopper/framework (Packagist): upgrade to 2.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47740 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-47740?** Check whether you run shopper/framework (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- shopper/framework (Packagist): upgrade to 2.8.0 or later

  ```sh
  composer require shopper/framework:^2.8.0
  ```


## Technical details

An authorization bypass vulnerability exists in Shopper's admin panel due to missing permission checks on several Filament actions. Specifically, actions such as 'cancel', 'mark paid', 'mark complete', 'capture payment', 'archive', and 'start processing' were incorrectly accessible to users with only 'read_orders' permissions instead of requiring 'edit_orders'. Additionally, shipment-related actions like 'mark delivered' and 'edit tracking' only required 'browse_orders' access. An authenticated attacker with low-level read access can exploit this to manipulate the order lifecycle and trigger real-world payment captures via Payment Service Providers (PSPs). The issue is resolved in version 2.8.0 by implementing proper authorization gates on these actions.

## Affected products

- Shopper Labs shopper/framework < 2.8.0

## Identifiers

- CVE-2026-47740
- GHSA-f946-9qp6-vgch

## Timeline

- 2026-05-11: patched: Fix merged in pull request #511
- 2026-05-11: advisory: GitHub Security Advisory published
- 2026-05-29: disclosed: CVE-2026-47740 published to NVD

## References

- [https://github.com/shopperlabs/shopper/pull/511](https://github.com/shopperlabs/shopper/pull/511)
- [https://github.com/shopperlabs/shopper/security/advisories/GHSA-f946-9qp6-vgch](https://github.com/shopperlabs/shopper/security/advisories/GHSA-f946-9qp6-vgch)

## Related threats

- [Shopper privilege escalation via improper Livewire authorization](https://junglewise.ai/threats/cve-2026-56828-shopper-privilege-escalation-via-improper-livewire-authorization)
- [Shopper Framework missing authorization in Settings components](https://junglewise.ai/threats/cve-2026-56826-shopper-framework-missing-authorization-in-settings-components)
- [Shopper Framework negative discount validation bypass](https://junglewise.ai/threats/cve-2026-56831-shopper-framework-negative-discount-validation-bypass)
- [Shopper Media component missing authorization in store()](https://junglewise.ai/threats/cve-2026-56830-shopper-media-component-missing-authorization-in-store)
- [Shopper VariantStock missing authorization and unlocked property](https://junglewise.ai/threats/cve-2026-56829-shopper-variantstock-missing-authorization-and-unlocked-property)