Executive brief
Shopper is an e-commerce administration panel. A security flaw in the team management settings allows any logged-in user to bypass security checks to create new roles or delete other users, including administrators. This could allow a low-level user to take full control of the store, access customer data, and lock out legitimate staff.
Technical details
The vulnerability consists of two defects in the Shopper RBAC system. First, the `Settings/Team/Index` component lacked a `mount()` authorization check, allowing any authenticated user to access public actions such as role creation and user deletion. Second, `Settings/Team/RolePermission` incorrectly used the read-only `view_users` permission to gate write actions, allowing users with minimal view rights to grant themselves administrative permissions like `manage_users`. An attacker with any valid account can exploit these to escalate to full administrator privileges. The issue is resolved in version 2.8.0 by implementing proper authorization checks against the `manage_users` permission.
Affected products
- Shopper Labs Shopper Framework < 2.8.0
Timeline
- 2026-05-20: disclosed: Initial report by baradika
- 2026-05-29: advisory: NVD publication date
- 2026-06-05: patched: GitHub Advisory published and fix confirmed in v2.8.0