CVE-2026-114387

Name of the Vulnerable Software and Affected Versions Shopper versions 2.0.0 through 2.5.9

Description A missing authorization issue allows users with access dashboard privileges to create administrator accounts and grant permissions. This is achieved by directly calling the CreateTeamMember::store() or Permissions::togglePermission() functions via the /livewire/update endpoint, leading to full administrative privilege escalation.

Recommendations Update Shopper to version 2.6.0 or later. As a temporary mitigation, restrict access to the /livewire/update endpoint for users with limited dashboard privileges.