CVE-2026-114387 shopperlabs CVE debrief

Who should care

Defenders managing Shopper installations, particularly those with untrusted or internet-exposed admin panels, should assess exposure and apply patches or compensating controls. Defenders should prioritize verifying exposure and applying patches for Shopper versions before 2.6.0, focusing on restricting access to the admin panel and monitoring for suspicious Livewire activity. Operators of Shopper installations should review and limit access_dashboard

Why it matters

CVE-2026-114387 is a high-severity vulnerability in Shopper that allows attackers to create admin accounts and escalate privileges. Defenders should prioritize verifying exposure, applying patches, and monitoring for suspicious activity.

• Potential privilege escalation to full administrator
• Creation of unauthorized admin accounts
• Bypass of intended access controls
• Possible lateral movement within the system

Technical summary

The vulnerability allows an attacker with access_dashboard permissions to create admin accounts and escalate privileges by directly calling Livewire functions over /livewire/update. This is due to missing authorization checks in the CreateTeamMember and Permissions components. The vulnerability is a high-severity issue in Shopper that allows attackers to create admin accounts and escalate privileges. Defenders should prioritize verifying exposure, applying patches, and monitoring for suspicious activity. The CVE record and NVD entry provide details on the vulnerability.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for Shopper versions before 2.6.0, focusing on restricting access to the admin panel and monitoring for suspicious Livewire activity.

Recommended defensive actions

• Verify Shopper version and restrict access to admin panels
• Monitor Livewire activity for suspicious calls
• Apply patches or updates to version 2.6.0 or later
• Review and limit access_dashboard permissions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Vendor information is limited, with a low confidence level. Source references include GitHub code snippets and commit history. The vulnerability allows an attacker with access_dashboard permissions to create admin accounts and escalate privileges by directly calling Livewire functions over /livewire/update.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.