PatchSiren cyber security CVE debrief
CVE-2026-47740 shopperlabs CVE debrief
A privilege escalation vulnerability in Shopper, a headless e-commerce admin panel, allows authenticated low-privilege users to perform unauthorized order lifecycle mutations and trigger real payment captures. The issue stems from improper authorization checks on multiple Filament actions within the Order detail and Order shipments tables. Specifically, actions including cancel, mark paid, mark complete, capture payment, archive, start processing, mark delivered, and edit tracking were accessible with read-only permissions (read_orders or browse_orders) rather than requiring appropriate write permissions (edit_orders). The capturePayment action is particularly critical as it could initiate actual funds movement through payment service providers. This vulnerability affects versions prior to 2.8.0 and was disclosed on May 29, 2026.
- Vendor
- shopperlabs
- Product
- shopper
- CVSS
- HIGH 8.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-29
- Original CVE updated
- 2026-05-29
- Advisory published
- 2026-05-29
- Advisory updated
- 2026-05-29
Who should care
Organizations operating Shopper-based e-commerce platforms with multi-role admin access, particularly those with read-only staff or external users requiring order visibility. Payment operations teams should prioritize this due to the real funds movement risk from unauthorized capturePayment execution.
Technical summary
The vulnerability exists in the Filament-based admin panel of Shopper, where multiple table actions on Order detail and Order shipments views lacked proper permission enforcement. The Order detail actions (cancel, mark paid, mark complete, capture payment, archive, start processing) required only read_orders permission instead of edit_orders. The Order shipments actions (mark delivered, edit tracking) required only browse_orders permission. This authorization bypass enables read-only users to alter order states and trigger financial transactions. The fix in version 2.8.0 implements proper permission checks on these actions.
Defensive priority
HIGH
Recommended defensive actions
- Upgrade Shopper to version 2.8.0 or later to remediate this vulnerability
- Review and audit order action permissions for all authenticated user roles to ensure least-privilege access
- Implement additional authorization checks at the application layer for sensitive order lifecycle operations
- Monitor payment service provider logs for unauthorized capture transactions that may have occurred prior to patching
- Conduct access control review of all Filament table actions within the admin panel to identify similar authorization gaps
Evidence notes
CVE published 2026-05-29T19:16:25.620Z; modified 2026-05-29T20:17:38.110Z. Advisory references GitHub Security Advisory GHSA-f946-9qp6-vgch and pull request #511. CVSS 3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. CWE-285 (Improper Authorization) and CWE-862 (Missing Authorization) identified.
Official resources
2026-05-29