{"id":"CVE-2026-56828","kind":"vulnerability","aliases":["CVE-2026-56828"],"related":[],"title":"Shopper admin: low-privilege staff can grant admin and delete roles","description":"Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain authorization gaps after the earlier team-settings authorization fix. A staff member with only `view_users` and `access_dashboard` can mutate permissions, create an administrator, or delete roles. In `packages/admin/src/Livewire/Components/Settings/Team/Permissions.php`, `togglePermission` and `removePermission` authorize `view_users` rather than the stronger `access_setting` permission; `packages/admin/resources/views/livewire/components/settings/team/permissions.blade.php` exposes permission IDs in `wire:click` handlers. The attacker can grant arbitrary permissions to the bound role, including `access_setting` on the attacker's own role, or delete permission definitions. In `packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php`, `mount()` and `store()` also accept `view_users`, and the client-selected `role_id` can identify the admin role, allowing creation of a pre-verified administrator with an attacker-chosen password. In `packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php`, `deleteAction` has no action authorization and is only conditioned on `can_be_removed`, while page access requires `view_users`. Deleting a removable role removes access for assigned users, enabling RBAC denial of service as well as privilege escalation. This issue is fixed in version 2.8.1.","summary":"Shopper is a headless e-commerce admin panel, and versions 2.8.0 through 2.8.1 have authorization gaps in three team and permission components. A staff member with only view_users and access_dashboard can change role permissions, create a pre-verified administrator with a chosen password, or delete removable roles.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","laravel","package","php","self-hosted","shopper"],"not_affected_if":["no-staff-with-view_users","running-2.8.1-or-later"],"how_to_check":"- Check the installed Shopper version in composer.lock or with `composer show`; versions from `2.8.0` up to but not including `2.8.1` are affected.\n- Review staff accounts that hold only view_users and access_dashboard, since they are the ones who can exploit the gap.","fix":"- Upgrade Shopper to `2.8.1`, which the advisory says fixes the issue.\n- Review administrator accounts and role permissions for changes made by low-privilege staff before the upgrade.","status":"open","published_at":"2026-10-28T16:17:08+00:00","first_seen_at":"2026-10-28T16:33:49+00:00","triaged_at":"2026-10-28T16:35:49+00:00","updated_at":"2026-10-28T16:35:49+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T16:35:49Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Shopper to `2.8.1`, which the advisory says fixes the issue.\n- Review administrator accounts and role permissions for changes made by low-privilege staff before the upgrade.","reach":"internet","title":"Shopper admin: low-privilege staff can grant admin and delete roles","impact":"high","summary":"Shopper is a headless e-commerce admin panel, and versions 2.8.0 through 2.8.1 have authorization gaps in three team and permission components. A staff member with only view_users and access_dashboard can change role permissions, create a pre-verified administrator with a chosen password, or delete removable roles.","category":"package","nicknames":[],"who_cares":["laravel","php","shopper","ecommerce","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Staff user creates an administrator and takes over the shop admin","analyst_note":"","how_to_check":"- Check the installed Shopper version in composer.lock or with `composer show`; versions from `2.8.0` up to but not including `2.8.1` are affected.\n- Review staff accounts that hold only view_users and access_dashboard, since they are the ones who can exploit the gap.","needs_analyst":false,"not_affected_if":["running-2.8.1-or-later","no-staff-with-view_users"],"who_is_affected":"Teams running Shopper 2.8.0 or 2.8.1 with staff accounts that have the view_users permission can exploit this. The gap sits in the team settings and permission screens of the admin panel, so the risk depends on who holds staff access rather than on public exposure of data. Installations already on 2.8.1 or later, or with no such staff accounts, are not affected by these paths.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.001068,"input_tokens":3707,"output_tokens":1394,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-56828':15A,18A '2.8.0':38B,88C '2.8.1':40B,90C,253C 'accept':178C 'access':58B,115C,138C,160C,224C,233C 'action':212C 'admin':2A,9A,34B,85C,94C,191C 'administr':69B,122C,200C 'allow':193C 'also':177C 'arbitrari':153C 'assign':235C 'attack':150C,164C,204C 'attacker-chosen':203C 'author':42B,97C,105C,131C,213C 'bound':157C 'chang':61B 'chosen':72B,205C 'click':147C 'client':184C 'client-select':183C 'commerc':33B,84C 'compon':49B,95C 'condit':217C 'creat':64B,120C 'creation':194C 'cve':13A,16A 'dashboard':59B,116C 'definit':171C 'delet':11A,75B,124C,169C,228C 'deleteact':209C 'denial':239C 'e':32B,83C 'e-commerc':31B,82C 'earlier':101C 'ecommerc':19B 'enabl':237C 'escal':246C 'expos':142C 'fix':106C,250C 'gap':43B,98C 'grant':8A,152C 'handler':148C 'headless':30B,81C 'host':25B 'id':144C,187C 'identifi':189C 'includ':159C 'issu':248C 'laravel':20B 'livewir':93C 'low':4A 'low-privileg':3A 'member':52B,109C 'mount':174C 'mutat':118C 'packag':21B 'packages/admin/resources/views/livewire/components/settings/team/permissions.blade.php':141C 'packages/admin/src/livewire/components/settings/team/permissions.php':127C 'packages/admin/src/livewire/pages/settings/team/rolepermission.php':208C 'packages/admin/src/livewire/slideovers/createteammember.php':173C 'page':223C 'panel':35B,86C 'password':73B,206C 'permiss':48B,63B,119C,140C,143C,154C,170C 'php':22B 'pre':67B,198C 'pre-verifi':66B,197C 'privileg':5A,245C 'rather':134C 'rbac':238C 'remov':76B,221C,230C,232C 'removepermiss':130C 'requir':225C 'retain':96C 'role':12A,62B,77B,125C,158C,167C,186C,192C,231C 'select':185C 'self':24B 'self-host':23B 'servic':241C 'set':104C,139C,161C 'shopper':1A,26B,27B,78C,92C 'staff':6A,51B,108C 'store':176C 'stronger':137C 'team':46B,103C 'team-set':102C 'three':45B,91C 'togglepermiss':128C 'user':56B,113C,133C,180C,227C,236C 'verifi':68B,199C 'version':37B,252C 'view':55B,112C,132C,179C,226C 'well':243C 'wire':146C","nicknames":[],"mitigations":[],"who_affected":"Teams running Shopper 2.8.0 or 2.8.1 with staff accounts that have the view_users permission can exploit this. The gap sits in the team settings and permission screens of the admin panel, so the risk depends on who holds staff access rather than on public exposure of data. Installations already on 2.8.1 or later, or with no such staff accounts, are not affected by these paths.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T16:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-56828","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56828","severity":null,"published_at":"2026-10-28T16:17:08+00:00","modified_at":"2026-10-28T16:17:08+00:00","first_seen_at":"2026-10-28T16:33:49+00:00","fetched_at":"2026-10-28T16:33:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}