---
id: "CVE-2026-56828"
kind: "vulnerability"
aliases: ["CVE-2026-56828"]
title: "Shopper admin: low-privilege staff can grant admin and delete roles"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ecommerce", "laravel", "package", "php", "self-hosted", "shopper"]
not_affected_if: ["no-staff-with-view_users", "running-2.8.1-or-later"]
published_at: "2026-10-28T16:17:08+00:00"
first_seen_at: "2026-10-28T16:33:49+00:00"
updated_at: "2026-10-28T16:35:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56828", "first_seen_at": "2026-10-28T16:33:49+00:00"}]
---

# Shopper admin: low-privilege staff can grant admin and delete roles

Shopper is a headless e-commerce admin panel, and versions 2.8.0 through 2.8.1 have authorization gaps in three team and permission components. A staff member with only view_users and access_dashboard can change role permissions, create a pre-verified administrator with a chosen password, or delete removable roles.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Shopper version in composer.lock or with `composer show`; versions from `2.8.0` up to but not including `2.8.1` are affected.
- Review staff accounts that hold only view_users and access_dashboard, since they are the ones who can exploit the gap.

## Fix

- Upgrade Shopper to `2.8.1`, which the advisory says fixes the issue.
- Review administrator accounts and role permissions for changes made by low-privilege staff before the upgrade.

## Timeline

- 2026-10-28T16:33:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-56828

## From the sources

Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain authorization gaps after the earlier team-settings authorization fix. A staff member with only `view_users` and `access_dashboard` can mutate permissions, create an administrator, or delete roles. In `packages/admin/src/Livewire/Components/Settings/Team/Permissions.php`, `togglePermission` and `removePermission` authorize `view_users` rather than the stronger `access_setting` permission; `packages/admin/resources/views/livewire/components/settings/team/permissions.blade.php` exposes permission IDs in `wire:click` handlers. The attacker can grant arbitrary permissions to the bound role, including `access_setting` on the attacker's own role, or delete permission definitions. In `packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php`, `mount()` and `store()` also accept `view_users`, and the client-selected `role_id` can identify the admin role, allowing creation of a pre-verified administrator with an attacker-chosen password. In `packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php`, `deleteAction` has no action authorization and is only conditioned on `can_be_removed`, while page access requires `view_users`. Deleting a removable role removes access for assigned users, enabling RBAC denial of service as well as privilege escalation. This issue is fixed in version 2.8.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_