CVE-2026-47740

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Multiple Filament actions on the admin Order detail and Order shipments table were callable by an authenticated low-privilege user without the permission required to mutate orders. The order detail actions cancel, mark paid, mark complete, capture payment, archive, and start processing were callable with the read-only read_orders permission and did not require edit_orders. capturePayment could trigger an actual PSP capture (real funds movement). The order shipments table actions mark delivered and edit tracking were callable with the read-only browse_orders permission. A user with read access to orders could therefore alter the lifecycle of every order in the panel and trigger real-world payment captures. This vulnerability is fixed in 2.8.0.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/shopperlabs/shopper/pull/511
https://github.com/shopperlabs/shopper/security/advisories/GHSA-f946-9qp6-vgch

Configurations

No configuration.

History

No history.

Information

Published : 2026-05-29 19:16

Updated : 2026-07-22 06:10

NVD link : CVE-2026-47740

Mitre link : CVE-2026-47740

CVE.ORG link : CVE-2026-47740

JSON object : View

Products Affected

No product.

CWE

CWE-285

Improper Authorization

CWE-862

Missing Authorization

{"id": "CVE-2026-47740", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47740", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-02T01:50:41.879905Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "shopperlabs", "product": "shopper", "versions": [{"status": "affected", "version": "< 2.8.0"}]}]}], "published": "2026-05-29T19:16:25.620", "references": [{"url": "https://github.com/shopperlabs/shopper/pull/511", "source": "security-advisories@github.com"}, {"url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-f946-9qp6-vgch", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-285"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Multiple Filament actions on the admin Order detail and Order shipments table were callable by an authenticated low-privilege user without the permission required to mutate orders. The order detail actions cancel, mark paid, mark complete, capture payment, archive, and start processing were callable with the read-only read_orders permission and did not require edit_orders. capturePayment could trigger an actual PSP capture (real funds movement). The order shipments table actions mark delivered and edit tracking were callable with the read-only browse_orders permission. A user with read access to orders could therefore alter the lifecycle of every order in the panel and trigger real-world payment captures. This vulnerability is fixed in 2.8.0."}, {"lang": "es", "value": "Shopper es un Panel de administraci\u00f3n de e-commerce Headless. Antes de la versi\u00f3n 2.8.0, m\u00faltiples acciones de Filament en la tabla de detalles de pedidos y env\u00edos de pedidos del administrador pod\u00edan ser invocadas por un usuario autenticado con privilegios bajos sin el permiso requerido para modificar pedidos. Las acciones de detalle de pedidos cancelar, marcar como pagado, marcar como completado, capturar pago, archivar e iniciar procesamiento pod\u00edan ser invocadas con el permiso de solo lectura read_orders y no requer\u00edan edit_orders. capturePayment pod\u00eda desencadenar una captura real de PSP (movimiento real de fondos). Las acciones de la tabla de env\u00edos de pedidos marcar como entregado y editar seguimiento pod\u00edan ser invocadas con el permiso de solo lectura browse_orders. Un usuario con acceso de lectura a los pedidos pod\u00eda, por lo tanto, alterar el ciclo de vida de cada pedido en el panel y desencadenar capturas de pago en el mundo real. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.8.0."}], "lastModified": "2026-07-22T06:10:00.170", "sourceIdentifier": "security-advisories@github.com"}