CVE-2026-114387highCWE-862

CVE-2026-114387: falha de alta gravidade em shopperlabs shopper

Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Components

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar shopper

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.3%
Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store() or Permissions::togglePermission() directly over /livewire/update to create admin accounts and escalate to full administrator.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
shopperlabs · shopper
CVEs relacionadas — shopperlabs shopper

No mesmo produto, das mais perigosas para as menos.

CVE-2026-56827HIGHShopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliersEPSS 0.5%CVE-2026-56829HIGHShopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock componentEPSS 0.5%CVE-2026-56825HIGHShopper: Missing authorization on product removal actions in CollectionProducts componentEPSS 0.5%CVE-2026-56828HIGHShopper: read-only team permissions allow administrator creation and permission escalationEPSS 0.4%CVE-2026-56831MEDIUMShopper: Negative discount values accepted and propagated through order calculation pipelineEPSS 0.4%CVE-2026-56830MEDIUMShopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorizationEPSS 0.4%