PT-2026-90544

CVE-2026-56828

Published

2026-09-11

Updated

2026-10-28

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Shopper versions 2.8.0 through 2.8.0

Description Three Livewire admin components contain authorization gaps that allow a staff member with only view users and access dashboard permissions to perform privileged actions. This improper authorization enables an attacker to escalate their own privileges by granting arbitrary permissions to their role, create a new administrator account with a chosen password, or delete roles and permission definitions, leading to a Role-Based Access Control (RBAC) denial of service.

The technical details of the affected components are as follows:

In packages/admin/src/Livewire/Components/Settings/Team/Permissions.php, the functions togglePermission() and removePermission() incorrectly authorize the view users permission instead of the required access setting permission. Additionally, the file packages/admin/resources/views/livewire/components/settings/team/permissions.blade.php exposes permission IDs in wire:click handlers.
In packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php, the mount() and store() functions accept the view users permission, allowing the creation of a pre-verified administrator via the role id variable.
In packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php, the deleteAction function lacks action authorization and only checks if the role can be removed, while page access is granted via view users.

Recommendations Update Shopper to version 2.8.1. As a temporary workaround, restrict the view users permission to only highly trusted personnel until the update is applied.

Exploitability

Exploit

Fix

Impacts

Researchers

Therawdev

Vendors

Affected products

Weakness enumeration

CWE-285: Improper Authorization

CWE-862: Missing Authorization

Related identifiers