CVE-2026-62991

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route /cpanel/customers/{user}/show in packages/admin/src/Livewire/Pages/Customers/Show.php checks read_customers but looks up an arbitrary user ID without applying the customers role scope used by the listing. Authenticated staff holding access_dashboard and read_customers can change the user ID to retrieve administrator or staff profiles despite lacking view_users, which protects the separate team-management interface. The flaw exposes account profile data and permits user-ID enumeration through differing success, denial, and not-found responses. If the same role also holds delete_customers, anonymizeAction() operates on the unrestricted loaded user model and can enable destructive follow-up against non-customer accounts. This issue is fixed in version 2.10.1.

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route /cpanel/customers/{user}/show in packages/admin/src/Livewire/Pages/Customers/Show.php checks read_customers but looks up an arbitrary user ID without applying the customers role scope used by the listing. Authenticated staff holding access_dashboard and read_customers can change the user ID to retrieve administrator or staff profiles despite lacking view_users, which protects the separate team-management interface. The flaw exposes account profile data and permits user-ID enumeration through differing success, denial, and not-found responses. If the same role also holds delete_customers, anonymizeAction() operates on the unrestricted loaded user model and can enable destructive follow-up against non-customer accounts. This issue is fixed in version 2.10.1.

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route /cpanel/customers/{user}/show in packages/admin/src/Livewire/Pages/Customers/Show.php checks read_customers but looks up an arbitrary user ID without applying the customers role scope used by the listing. Authenticated staff holding access_dashboard and read_customers can change the user ID to retrieve administrator or staff profiles despite lacking view_users, which protects the separate team-management interface. The flaw exposes account profile data and permits user-ID enumeration through differing success, denial, and not-found responses. If the same role also holds delete_customers, anonymizeAction() operates on the unrestricted loaded user model and can enable destructive follow-up against non-customer accounts. This issue is fixed in version 2.10.1.

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route /cpanel/customers/{user}/show in packages/admin/src/Livewire/Pages/Customers/Show.php checks read_customers but looks up an arbitrary user ID without applying the customers role scope used by the listing. Authenticated staff holding access_dashboard and read_customers can change the user ID to retrieve administrator or staff profiles despite lacking view_users, which protects the separate team-management interface. The flaw exposes account profile data and permits user-ID enumeration through differing success, denial, and not-found responses. If the same role also holds delete_customers, anonymizeAction() operates on the unrestricted loaded user model and can enable destructive follow-up against non-customer accounts. This issue is fixed in version 2.10.1.