Live › vulnerability › CVE-2026-62991
Shopper is a headless e-commerce admin panel. A staff account with customer-read rights can change the user ID in the customer detail URL to load administrator and staff profiles it should not see.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 21:25 UTC. All times on this page are UTC.
Teams running Shopper versions before 2.10.1 where staff roles hold access_dashboard and read_customers. The exposure needs an authenticated staff account; deployments with no such roles, or running 2.10.1 or later, are not affected. If the same role also holds delete_customers, the flaw can reach destructive actions on non-customer accounts.
No product ranges from the sources yet.
composer show shopper/framework or the packages/admin package version in your lockfile.read_customers and access_dashboard and whether any of them also hold delete_customers.2.10.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route /cpanel/customers/{user}/show in packages/admin/src/Livewire/Pages/Customers/Show.php checks read_customers but looks up an arbitrary user ID without applying the customers role scope used by the listing. Authenticated staff holding access_dashboard and read_customers can change the user ID to retrieve administrator or staff profiles despite lacking view_users, which protects the separate team-management interface. The flaw exposes account profile data and permits user-ID enumeration through differing success, denial, and not-found responses. If the same role also holds delete_customers, anonymizeAction() operates on the unrestricted loaded user model and can enable destructive follow-up against non-customer accounts. This issue is fixed in version 2.10.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-62991")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.