CVE-2026-56828: Shopper privilege escalation via improper Livewire authorization

Executive brief

Shopper is an e-commerce admin framework built on Laravel/Livewire. A support staff member with read-only "view_users" permission can exploit three unpatched admin components to escalate their privileges: grant themselves any admin permission, create a new admin account with full privileges, or delete entire user roles. This allows complete takeover of the shop's administrative backend without admin credentials.

Technical details

The vulnerability stems from inconsistent authorization checks across three Livewire components (Permissions.php, CreateTeamMember.php, RolePermission.php). These components gate state-mutating actions on the read-only "view_users" permission instead of the write-level "access_setting" permission. Specifically: (1) Permissions::togglePermission and removePermission allow any view_users user to modify role permissions; (2) CreateTeamMember::store creates new admin accounts with attacker-chosen credentials without checking access_setting; (3) RolePermission::deleteAction lacks any authorization chain, permitting role deletion for users with only view_users. The components enumerate permission IDs directly in UI handlers, requiring no brute-force. The vulnerability is a residual gap from a prior partial fix (GHSA-f946-9qp6-vgch) and even appears in new code introduced by that patch. Requires valid staff login but no additional interaction.

Affected products

• Shopper Labs Shopper Framework >= 2.8.0, < 2.9.2

Timeline

• 2026-09-11: disclosed
• 2026-06-22: patched: Fix released in v2.9.2

References

• https://api.github.com/users/therawdev
• https://github.com/therawdev
• https://api.github.com/users/therawdev/gists%7B/gist_id%7D
• https://api.github.com/users/therawdev/repos
• https://avatars.githubusercontent.com/u/74800891?v=4
• https://api.github.com/users/therawdev/events%7B/privacy%7D