---
id: "CVE-2026-62991"
kind: "vulnerability"
aliases: ["CVE-2026-62991"]
title: "Shopper admin panel lets staff view admin and staff profiles"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["e-commerce", "laravel", "package", "php", "shopper"]
not_affected_if: ["no-customer-read-roles", "version-2.10.1-or-later"]
published_at: "2026-10-30T21:17:16+00:00"
first_seen_at: "2026-10-30T21:25:54+00:00"
updated_at: "2026-10-30T21:26:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62991", "first_seen_at": "2026-10-30T21:25:54+00:00"}]
---

# Shopper admin panel lets staff view admin and staff profiles

Shopper is a headless e-commerce admin panel. A staff account with customer-read rights can change the user ID in the customer detail URL to load administrator and staff profiles it should not see.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Shopper version with `composer show shopper/framework` or the `packages/admin` package version in your lockfile.
- Review which roles hold `read_customers` and `access_dashboard` and whether any of them also hold `delete_customers`.

## Fix

- Upgrade Shopper to `2.10.1`.

## Timeline

- 2026-10-30T21:25:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62991

## From the sources

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route `/cpanel/customers/{user}/show` in `packages/admin/src/Livewire/Pages/Customers/Show.php` checks `read_customers` but looks up an arbitrary user ID without applying the `customers` role scope used by the listing. Authenticated staff holding `access_dashboard` and `read_customers` can change the user ID to retrieve administrator or staff profiles despite lacking `view_users`, which protects the separate team-management interface. The flaw exposes account profile data and permits user-ID enumeration through differing success, denial, and not-found responses. If the same role also holds `delete_customers`, `anonymizeAction()` operates on the unrestricted loaded user model and can enable destructive follow-up against non-customer accounts. This issue is fixed in version 2.10.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_