shopperlabs shopper authorization bypass in Livewire admin components

Executive brief

Shopper is an e-commerce framework for Laravel. Multiple security flaws in its admin panel allowed low-privileged users to perform unauthorized actions, such as modifying orders, capturing payments, and deleting other users. These issues could lead to financial loss, unauthorized data modification, and full administrative takeover by a malicious staff member.

Technical details

Multiple Livewire components in the Shopper admin panel lacked proper authorization checks or used incorrect permissions for sensitive actions. Key issues included: order management actions (cancel, capture payment) requiring only read permissions; product sub-forms lacking 'store' method authorization; and the team settings component lacking 'mount' authorization, allowing any authenticated user to create roles or delete users. Additionally, several Eloquent model properties were not locked, enabling client-side ID tampering, and a stored XSS vulnerability existed in the product barcode field due to unescaped HTML rendering. These vulnerabilities are addressed in version 2.8.0.

Affected products

• shopperlabs framework < 2.8.0

Timeline

• 2026-05-11: disclosed
• 2026-05-18: advisory: GitHub Advisory published
• 2026-05-18: patched: Fixed in v2.8.0

References

• https://api.github.com/users/baradika
• https://github.com/baradika
• https://api.github.com/users/baradika/gists%7B/gist_id%7D
• https://api.github.com/users/baradika/repos
• https://avatars.githubusercontent.com/u/137510281?v=4
• https://api.github.com/users/baradika/events%7B/privacy%7D