Key points
- The vulnerability affects Shopper installations running version 2.0.0 up to, but not including, 2.6.0.
- Attackers with dashboard access can exploit missing authorization to create administrators and grant permissions.
- The National Vulnerability Database rates the flaw as high severity with a CVSS score of 8.7.
Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard to create administrators and grant permissions. According to the National Vulnerability Database, this flaw enables attackers to call specific functions directly over the /livewire/update endpoint to create admin accounts and escalate to full administrator privileges. The issue is classified as CWE-862.
In plain English
Users who have limited access to the Shopper admin panel, specifically those with dashboard-only permissions, can bypass security checks. They can trigger backend functions that are meant for higher-level administrators. This allows them to create new administrator accounts or change permission settings for existing users. The exploit targets the Livewire update mechanism, which processes these requests without verifying if the user has the right authority to perform such critical actions.
The background
The National Vulnerability Database assigned CVE-2026-114387 to this issue. It carries a CVSS score of 8.7, which places it in the high severity range. The weakness is categorized under CWE-862, indicating a failure to restrict actions to authorized users. The affected software is maintained by ShopperLabs. This type of authorization failure is distinct from authentication flaws, as it involves users who are already logged in but lack the necessary clearance for specific administrative tasks.
What changes now
No fix has been confirmed yet for Shopper versions prior to 2.6.0. Organizations using this software must assess their exposure immediately. The vulnerability allows for direct privilege escalation, meaning a compromised low-level account can lead to full system control. Security teams should monitor for unauthorized administrative account creation or permission changes. Until a patch is released, reducing the attack surface by limiting dashboard access to trusted personnel is the primary mitigation strategy.
Who needs to act first
Security operations teams should prioritize systems where external vendors or contractors have dashboard access. Check whether any users with limited privileges have created new administrator accounts recently. Review access logs for unusual activity on the Livewire update endpoints. If possible, restrict network access to the admin panel to internal IP addresses only. Ensure that multi-factor authentication is enforced for all administrative accounts to limit the impact of credential compromise. Test any temporary restrictions in a non-production environment before applying them broadly.
Background: Privilege escalation attacks
Monitor for unexpected process spawning from low-privilege contexts, changes to system binaries, and abnormal access to sensitive configuration files. Correlate these signals with user behavior baselines to catch lateral movement before it becomes a full compromise.
Read the full guide: Detect Privilege Escalation Attacks: Log Signals and Blind Spots
What to do and how to stay safe: Shopper
- Audit all user accounts with dashboard access to ensure they belong to verified personnel.
- Monitor server logs for calls to CreateTeamMember::store() or Permissions::togglePermission() from low-privilege users.
- Restrict access to the /livewire/update endpoint using web application firewalls or network rules.
- Wait for an official update from ShopperLabs before applying any unverified workarounds.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Shopper are affected by CVE-2026-114387?
The vulnerability affects Shopper versions starting from 2.0.0 up to, but not including, 2.6.0.
Is there a patch available for this vulnerability?
No fix has been confirmed yet for the affected versions of Shopper.
What is the severity of this vulnerability?
The National Vulnerability Database rates CVE-2026-114387 as high severity with a CVSS score of 8.7.
