Live › vulnerability › CVE-2026-56828
Go to dashboardShopper is a headless e-commerce admin panel, and versions 2.8.0 through 2.8.1 have authorization gaps in three team and permission components. A staff member with only view_users and access_dashboard can change role permissions, create a pre-verified administrator with a chosen password, or delete removable roles.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 16:33 UTC. All times on this page are UTC.
Teams running Shopper 2.8.0 or 2.8.1 with staff accounts that have the view_users permission can exploit this. The gap sits in the team settings and permission screens of the admin panel, so the risk depends on who holds staff access rather than on public exposure of data. Installations already on 2.8.1 or later, or with no such staff accounts, are not affected by these paths.
No product ranges from the sources yet.
composer show; versions from 2.8.0 up to but not including 2.8.1 are affected.2.8.1, which the advisory says fixes the issue.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain authorization gaps after the earlier team-settings authorization fix. A staff member with only view_users and access_dashboard can mutate permissions, create an administrator, or delete roles. In packages/admin/src/Livewire/Components/Settings/Team/Permissions.php, togglePermission and removePermission authorize view_users rather than the stronger access_setting permission; packages/admin/resources/views/livewire/components/settings/team/permissions.blade.php exposes permission IDs in wire:click handlers. The attacker can grant arbitrary permissions to the bound role, including access_setting on the attacker's own role, or delete permission definitions. In packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php, mount() and store() also accept view_users, and the client-selected role_id can identify the admin role, allowing creation of a pre-verified administrator with an attacker-chosen password. In packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php, deleteAction has no action authorization and is only conditioned on can_be_removed, while page access requires view_users. Deleting a removable role removes access for assigned users, enabling RBAC denial of service as well as privilege escalation. This issue is fixed in version 2.8.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-56828")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.