{"schema":"threatline.record/2","record":{"id":"CVE-2026-56828","aliases":["GHSA-j328-xmgp-j4q3"],"summary":"Shopper: read-only team permissions allow administrator creation and permission escalation","details":"Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain authorization gaps after the earlier team-settings authorization fix. A staff member with only `view_users` and `access_dashboard` can mutate permissions, create an administrator, or delete roles. In `packages/admin/src/Livewire/Components/Settings/Team/Permissions.php`, `togglePermission` and `removePermission` authorize `view_users` rather than the stronger `access_setting` permission; `packages/admin/resources/views/livewire/components/settings/team/permissions.blade.php` exposes permission IDs in `wire:click` handlers. The attacker can grant arbitrary permissions to the bound role, including `access_setting` on the attacker's own role, or delete permission definitions. In `packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php`, `mount()` and `store()` also accept `view_users`, and the client-selected `role_id` can identify the admin role, allowing creation of a pre-verified administrator with an attacker-chosen password. In `packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php`, `deleteAction` has no action authorization and is only conditioned on `can_be_removed`, while page access requires `view_users`. Deleting a removable role removes access for assigned users, enabling RBAC denial of service as well as privilege escalation. This issue is fixed in version 2.8.1.","categories":["Libraries & packages"],"product":"shopper","vendor":"shopperlabs","ecosystem":"Packagist","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-56828","source_modified_at":"2026-10-28T15:40:39.294Z","fetched_at":"2026-10-28T15:55:58.673066Z","product":"shopper","vendor":"shopperlabs","versions":[{"version":">= 2.8.0, < 2.8.1","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-j328-xmgp-j4q3","source_modified_at":"2026-09-11T21:45:09.888222940Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"name":"shopper/framework","ecosystem":"Packagist","purl":"pkg:composer/shopper/framework"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0"},{"fixed":"2.9.2"}]}],"versions":["v2.8.0","v2.8.1","v2.9.0","v2.9.1"]}],"fixed_versions":[{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-j328-xmgp-j4q3","source_modified_at":"2026-09-11T21:45:09.888222940Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"name":"shopper/framework","ecosystem":"Packagist","purl":"pkg:composer/shopper/framework"},"version":"2.9.2"}],"cvss":8.8,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T15:40:39.294Z","modified_at":"2026-10-28T15:40:39.294Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-56828","fetched_at":"2026-10-28T15:55:58.673066Z","source_modified_at":"2026-10-28T15:40:39.294Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-j328-xmgp-j4q3","fetched_at":"2026-10-28T15:55:58.673066Z","source_modified_at":"2026-09-11T21:45:09.888222940Z"}],"sources":["CVE List","OSV"],"references":[{"source":"CVE List","url":"https://github.com/shopperlabs/shopper/security/advisories/GHSA-j328-xmgp-j4q3","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/shopperlabs/shopper/pull/514","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/shopperlabs/shopper/commit/ac9a76044a8e4a2b570b438d66cf3007f3dc479e","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/shopperlabs/shopper/compare/v2.8.1...v2.9.2","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/shopperlabs/shopper/releases/tag/v2.8.1","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-28T15:40:39.294Z","content_hash":"4769bf76598d924fbaad424412fc691671af7c7651d376278948d8dd8e725d0d"}}