Shopper: read-only team permissions allow administrator creation and permission escalation

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain authorization gaps after the earlier team-settings authorization fix. A staff member with only view_users and access_dashboard can mutate permissions, create an administrator, or delete roles. In packages/admin/src/Livewire/Components/Settings/Team/Permissions.php, togglePermission and removePermission authorize view_users rather than the stronger access_setting permission; packages/admin/resources/views/livewire/components/settings/team/permissions.blade.php exposes permission IDs in wire:click handlers. The attacker can grant arbitrary permissions to the bound role, including access_setting on the attacker's own role, or delete permission definitions. In packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php, mount() and store() also accept view_users, and the client-selected role_id can identify the admin role, allowing creation of a pre-verified administrator with an attacker-chosen password. In packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php, deleteAction has no action authorization and is only conditioned on can_be_removed, while page access requires view_users. Deleting a removable role removes access for assigned users, enabling RBAC denial of service as well as privilege escalation. This issue is fixed in version 2.8.1.

Etkilenen sürümler1 yazılım

Kaynaklar7 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…hopper/security/advisories/GHSA-j328-xmgp-j4q3 Diğer
• github.com/shopperlabs/shopper/pull/514 Diğer
• github.com/…ommit/ac9a76044a8e4a2b570b438d66cf3007f3dc479e Diğer
• github.com/shopperlabs/shopper/compare/v2.8.1...v2.9.2 Diğer
• github.com/shopperlabs/shopper/releases/tag/v2.8.1 Diğer

Kayıt geçmişi

1. 28 Eki 2026 18:40Yayımlandı

İlgili açıklar

• 8,8 CVE-2026-114387Shopper'da yetkisiz Livewire bileşenleri nedeniyle yetki yükseltme açığı
• 8,8 CVE-2026-116778FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution
• 8,3 CVE-2026-59979YosemiteCrew: Missing organization authorization on service and PMS library/template routes
• 5,4 CVE-2026-50542Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure
• 4,3 CVE-2026-50543Xibo: Missing Authorization on POST /displaygroup/criteria/{displayGroupId} Allows Arbitrary Scheduling Criteria Injection to Player Devices
• 6,5 CVE-2026-50539Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments