Live › vulnerability › CVE-2026-114387
Go to dashboardShopper is a Laravel e-commerce admin panel. A user who only holds the access_dashboard permission can call its team-member and permission endpoints directly and create administrator accounts or grant themselves permissions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Unknown from the sources.
Upgrade Shopper to 2.6.0 or later (the affected range is 2.0.0 before 2.6.0).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store() or Permissions::togglePermission() directly over /livewire/update to create admin accounts and escalate to full administrator.
This page as .md · .json · in your agent: get_signal("CVE-2026-114387")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.