CVE-2026-56828

    Dashboard / Vulnerabilities / CVE-2026-56828

    CVE-2026-56828

    Published: 28 Oct 2026Last Modified: 5 Nov 2026

    Summary: Shopper: read-only team permissions allow administrator creation and permission escalation

    Details: Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain authorization gaps after the earlier team-settings authorization fix. A staff member with only `view_users` and `access_dashboard` can mutate permissions, create an administrator, or delete roles. In `packages/admin/src/Livewire/Components/Settings/Team/Permissions.php`, `togglePermission` and `removePermission` authorize `view_users` rather than the stronger `access_setting` permission; `packages/admin/resources/views/livewire/components/settings/team/permissions.blade.php` exposes permission IDs in `wire:click` handlers. The attacker can grant arbitrary permissions to the bound role, including `access_setting` on the attacker's own role, or delete permission definitions. In `packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php`, `mount()` and `store()` also accept `view_users`, and the client-selected `role_id` can identify the admin role, allowing creation of a pre-verified administrator with an attacker-chosen password. In `packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php`, `deleteAction` has no action authorization and is only conditioned on `can_be_removed`, while page access requires `view_users`. Deleting a removable role removes access for assigned users, enabling RBAC denial of service as well as privilege escalation. This issue is fixed in version 2.8.1.

    References: https://github.com/shopperlabs/shopper/compare/v2.8.1...v2.9.2, https://github.com/shopperlabs/shopper/releases/tag/v2.8.1, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56828.json, https://github.com/shopperlabs/shopper/security/advisories/GHSA-j328-xmgp-j4q3, https://nvd.nist.gov/vuln/detail/CVE-2026-56828, https://github.com/shopperlabs/shopper/commit/ac9a76044a8e4a2b570b438d66cf3007f3dc479e, https://github.com/shopperlabs/shopper/pull/514

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- fcd0c5920588702df5b874f432b1042abd77a50b
    Fixed -ac9a76044a8e4a2b570b438d66cf3007f3dc479e

    Affected versions

    v2.8.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-56828 | CVE-DB