Shopper vulnerabilities

Shopper, a Headless e-commerce Admin Panel prior to 2.8.0, contains two authorization defects in team settings. These allow any authenticated user to take over the RBAC system, create new roles, delete other users (including administrators), and escalate privileges to full panel administrator.

Shopper is a headless e-commerce admin panel. Prior to 2.10.1, the customer detail route /cpanel/customers/{user}/show checks read_customers but looks up an arbitrary user ID without applying the customers role scope used by the listing. Authenticated staff holding access_dashboard and read_customers can change the user ID to retrieve administrator or staff profiles despite lacking view_users. The flaw exposes account profile data and permits user-ID enumeration; combined with delete_customers, it can enable destructive follow-up against non-customer accounts. This issue is fixed in version 2.10.1.

A stored XSS vulnerability in the Shopper admin panel allows an authenticated staff member with content-upload permissions to store executable HTML or SVG files that are served without Content-Disposition or CSP headers. When an administrator opens such a file, the malicious script executes in their session and can create a new attacker-controlled administrator account with a chosen password. The issue affects versions 2.0.0 through 2.10.0 and 3.0.0-beta.1/beta.2, and is fixed in 2.10.1 and 3.0.0-beta.3.

In Shopper before 2.10.0, the Variants Livewire component in packages/admin/src/Livewire/Components/Products/Form/Variants.php exposes DeleteAction and DeleteBulkAction without server-side authorization. An authenticated staff user with edit_products can obtain the signed component state and permanently delete individual or multiple variants without the delete_product_variants permission. This can destroy the sellable catalogue and disrupt storefront product pages, cart, and checkout. The issue is fixed in version 2.10.0.

Shopper is a headless e-commerce admin panel. From 2.8.0 until 2.8.1, three Livewire admin components retain authorization gaps: a staff member with only `view_users` and `access_dashboard` can mutate permissions, create an administrator, or delete roles. They can grant arbitrary permissions including `access_setting` to their own role, create a pre-verified administrator with a chosen password, or delete roles, enabling privilege escalation and RBAC denial of service.

Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users with only `access_dashboard` to create administrators and grant permissions. Attackers can call `CreateTeamMember::store()` or `Permissions::togglePermission()` directly over `/livewire/update` to create admin accounts and escalate to full administrator.

In the Shopper Headless e-commerce Admin Panel, from version 2.0.0 until 2.9.2, authenticated users with only access_setting could invoke destructive actions through the Livewire endpoint because the settings components for shipping zones, tax zones, and tax rates did not enforce server-side delete authorization. This allowed deletion of carrier options, shipping zones, tax zones, and tax rates. The issue is fixed in version 2.9.2.

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixed_amount discount values, persists them in sh_discounts, and passes them through DiscountCalculator.php and Calculate.php without enforcing a positive-value invariant. Because the calculation subtracts discountTotal from the subtotal, a negative discount increases the resulting order total instead of reducing it.

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store() in Media.php without the edit_products authorization check used by sibling sub-forms. An authenticated staff user with browse_products can invoke the Livewire store action and replace the thumbnail and gallery images for a product whose Media component was initialized, even without product-edit permission.

In Shopper before 2.9.2, packages/admin/src/Livewire/Components/Products/VariantStock.php exposes stockAction() without edit_product_variants authorization and leaves public $variant client mutable because it lacks the Livewire Locked attribute. Any authenticated admin-panel user, including staff with only browse_products, can select an arbitrary product variant and inventory location through component state, then submit a positive or negative quantity adjustment. This permits browse-only staff to inflate stock, reduce stock, or force out-of-stock states for variants outside the current page. Fixed in version 2.9.2.

In Shopper before 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, Tag/Index.php, Brand/Index.php, Category/Index.php, and Supplier/Index.php omit server-side authorization while the pages require only browse_attributes, browse_tags, browse_brands, browse_categories, or browse_suppliers. A browse-only staff user can invoke DeleteBulkAction to mass delete attributes or tags and can invoke BulkAction::make('enabled') or BulkAction::make('disabled') to change attribute, brand, category, or supplier visibility. These operations can break product variants and substantially disrupt storefront catalog visibility. Fixed in version 2.9.2.

In Shopper before 2.9.2, packages/admin/src/Livewire/Components/Collection/CollectionProducts.php exposes Action::make('delete') and DeleteBulkAction::make() without delete_collections authorization, while public Collection $collection remains client mutable because it lacks the Livewire Locked attribute. An authenticated staff user with only browse_collections can invoke a Livewire removal action, substitute an arbitrary collection identifier, and detach selected products or empty the collection. This can disrupt catalog landing pages and promotions associated with the targeted collection. Fixed in version 2.9.2.

In the Shopper admin panel (headless e-commerce) prior to version 2.8.0, three related defects were found: missing Locked attribute on Eloquent model identifiers in Livewire components allowed data tampering, plaintext password transmission via a hidden form field led to sensitive data disclosure, and the product barcode field was rendered without proper escaping, enabling persistent XSS.

Shopper before version 2.8.0 does not check permissions for enable/disable, edit, and delete actions in admin tables for PaymentMethods, Currencies, and Carriers. A low-privilege user can disable payment methods, change the default currency, or disable carriers.

Shopper before version 2.8.0 has a vulnerability in Livewire components used in the product editor (Edit, Inventory, Seo, Shipping, Files), where the store() method lacks authorization. Any authenticated user can modify prices, stock, SEO metadata, shipping dimensions, and attachments of any product.

In Shopper, a headless e-commerce admin panel prior to version 2.8.0, the CreateOrderFromCartAction::execute function created the order before checking and incrementing the discount's total_use counter. Under concurrent checkout pressure (Black Friday, flash sale, viral coupon), the global usage_limit was silently exceeded: orders were committed with the discount fully applied while the counter blocked at the limit. The merchant had no signal of over-redemption.

Shopper, a Headless e-commerce Admin Panel, prior to version 2.8.0 contains a vulnerability where multiple Filament actions on order details and shipment tables could be called by an authenticated low-privilege user without the required permission to mutate orders. Actions like cancel, mark paid, mark complete, capture payment, archive, and start processing were callable with the read-only read_orders permission instead of the required edit_orders. capturePayment could trigger actual PSP capture (real funds movement). A user with read access could alter the lifecycle of every order and trigger real-world payment captures.