CVE-2026-47745
Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, the admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could disable every payment method on the store, disable or alter the default currency, or disable carriers. The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user. This vulnerability is fixed in 2.8.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, the admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could disable every payment method on the store, disable or alter the default currency, or disable carriers. The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user. This vulnerability is fixed in 2.8.0.
- Record
CVE-2026-47745- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2026-33406
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, the admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could disable every payment method on the store, disable or alter the default currency, or disable carriers. The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user. This vulnerability is fixed in 2.8.0.
- Record
EUVD-2026-33406- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-fxqw-97cc-7g5c
Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables
Impact
The admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could:
- Disable every payment method on the store, blocking checkout.
- Disable or alter the default currency, changing displayed prices and the exchange rate basis.
- Disable carriers, breaking shipping rate computation at checkout.
The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user.
Patches
Fixed in v2.8.0. Each toggle and per-record action now requires its matching permission (edit_payment_methods, edit_currencies, edit_carriers).
Upgrade via:
composer require shopper/admin:^2.8
Workarounds
None. Upgrade to v2.8.0.
- Record
GHSA-fxqw-97cc-7g5c- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
NVD
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, the admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could disable every payment method on the store, disable or alter the default currency, or disable carriers. The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user. This vulnerability is fixed in 2.8.0.
- Record
CVE-2026-47745- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSV
Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, the admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could disable every payment method on the store, disable or alter the default currency, or disable carriers. The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user. This vulnerability is fixed in 2.8.0.
- Record
CVE-2026-47745- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVGHSA-fxqw-97cc-7g5c
Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables
Impact
The admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could:
- Disable every payment method on the store, blocking checkout.
- Disable or alter the default currency, changing displayed prices and the exchange rate basis.
- Disable carriers, breaking shipping rate computation at checkout.
The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user.
Patches
Fixed in v2.8.0. Each toggle and per-record action now requires its matching permission (edit_payment_methods, edit_currencies, edit_carriers).
Upgrade via:
composer require shopper/admin:^2.8
Workarounds
None. Upgrade to v2.8.0.
- Record
GHSA-fxqw-97cc-7g5c- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
shopper/frameworkPackagist |
before 2.8.0 | 2.8.0 |
shopper/frameworkPackagist |
before 2.8.0, plus listed versions v2.0.0v2.0.0-alphav2.0.0-betav2.0.0-beta10v2.0.0-beta11 Show 45 moreShow lessv2.0.0-beta12v2.0.0-beta13v2.0.0-beta14v2.0.0-beta15v2.0.0-beta16v2.0.0-beta17v2.0.0-beta18v2.0.0-beta19v2.0.0-beta2v2.0.0-beta20v2.0.0-beta21v2.0.0-beta3v2.0.0-beta4v2.0.0-beta5v2.0.0-beta6v2.0.0-beta7v2.0.0-beta8v2.0.0-beta9v2.0.1v2.0.2v2.0.3v2.1.1v2.1.2v2.1.3v2.1.4v2.1.5v2.1.6v2.2v2.2.1v2.2.2v2.2.3v2.2.4v2.2.5v2.2.6v2.2.7v2.3v2.3.1v2.3.2v2.3.3v2.4.0v2.4.1v2.4.2v2.4.3v2.5.0v2.5.1 |
2.8.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-47745 is a medium vulnerability (CVSS 6.5) in Shopperdotcom Shopper, published May 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in shopper/framework 2.8.0.
References
Left out here: 9 versions. The JSON record has them.