CVE-2026-62990
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A stored XSS vulnerability in the Shopper admin panel allows an authenticated staff member with content-upload permissions to store executable HTML or SVG files that are served without Content-Disposition or CSP headers. When an administrator opens such a file, the malicious script executes in their session and can create a new attacker-controlled administrator account with a chosen password. The issue affects versions 2.0.0 through 2.10.0 and 3.0.0-beta.1/beta.2, and is fixed in 2.10.1 and 3.0.0-beta.3.
Risk Assessment
A low-privileged attacker can take full control of an administrator account, gaining access to customer data, orders, settings, and user/role management. The created account persists even after the malicious file is deleted.
Recommendation
Update Shopper to version 2.10.1 or 3.0.0-beta.3, and until then restrict upload permissions and enforce Content-Disposition: attachment and a restrictive CSP for the /storage/ directory.
Other vulnerabilities in Shopper
See all- CVE-2026-47744Critical
Shopper, a Headless e-commerce Admin Panel prior to 2.8.0, contains two authorization defects in team settings. These allow any authenticated user to take over the RBAC system, create new roles, delete other users (including administrators), and escalate privileges to full panel administrator.
- CVE-2026-62991Medium
Shopper is a headless e-commerce admin panel. Prior to 2.10.1, the customer detail route /cpanel/customers/{user}/show checks read_customers but looks up an arbitrary user ID without applying the customers role scope used by the listing. Authenticated staff holding access_dashboard and read_customers can change the user ID to retrieve administrator or staff profiles despite lacking view_users. The flaw exposes account profile data and permits user-ID enumeration; combined with delete_customers, it can enable destructive follow-up against non-customer accounts. This issue is fixed in version 2.10.1.
- CVE-2026-62989High
In Shopper before 2.10.0, the Variants Livewire component in packages/admin/src/Livewire/Components/Products/Form/Variants.php exposes DeleteAction and DeleteBulkAction without server-side authorization. An authenticated staff user with edit_products can obtain the signed component state and permanently delete individual or multiple variants without the delete_product_variants permission. This can destroy the sellable catalogue and disrupt storefront product pages, cart, and checkout. The issue is fixed in version 2.10.0.
- CVE-2026-56828High
Shopper is a headless e-commerce admin panel. From 2.8.0 until 2.8.1, three Livewire admin components retain authorization gaps: a staff member with only `view_users` and `access_dashboard` can mutate permissions, create an administrator, or delete roles. They can grant arbitrary permissions including `access_setting` to their own role, create a pre-verified administrator with a chosen password, or delete roles, enabling privilege escalation and RBAC denial of service.
- CVE-2026-114387High
Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users with only `access_dashboard` to create administrators and grant permissions. Attackers can call `CreateTeamMember::store()` or `Permissions::togglePermission()` directly over `/livewire/update` to create admin accounts and escalate to full administrator.
- CVE-2026-56826Medium
In the Shopper Headless e-commerce Admin Panel, from version 2.0.0 until 2.9.2, authenticated users with only access_setting could invoke destructive actions through the Livewire endpoint because the settings components for shipping zones, tax zones, and tax rates did not enforce server-side delete authorization. This allowed deletion of carrier options, shipping zones, tax zones, and tax rates. The issue is fixed in version 2.9.2.
- CVE-2026-56831Medium
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixed_amount discount values, persists them in sh_discounts, and passes them through DiscountCalculator.php and Calculate.php without enforcing a positive-value invariant. Because the calculation subtracts discountTotal from the subtotal, a negative discount increases the resulting order total instead of reducing it.
- CVE-2026-56830Medium
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store() in Media.php without the edit_products authorization check used by sibling sub-forms. An authenticated staff user with browse_products can invoke the Livewire store action and replace the thumbnail and gallery images for a product whose Media component was initialized, even without product-edit permission.
- CVE-2026-56829High
In Shopper before 2.9.2, packages/admin/src/Livewire/Components/Products/VariantStock.php exposes stockAction() without edit_product_variants authorization and leaves public $variant client mutable because it lacks the Livewire Locked attribute. Any authenticated admin-panel user, including staff with only browse_products, can select an arbitrary product variant and inventory location through component state, then submit a positive or negative quantity adjustment. This permits browse-only staff to inflate stock, reduce stock, or force out-of-stock states for variants outside the current page. Fixed in version 2.9.2.
- CVE-2026-56827High
In Shopper before 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, Tag/Index.php, Brand/Index.php, Category/Index.php, and Supplier/Index.php omit server-side authorization while the pages require only browse_attributes, browse_tags, browse_brands, browse_categories, or browse_suppliers. A browse-only staff user can invoke DeleteBulkAction to mass delete attributes or tags and can invoke BulkAction::make('enabled') or BulkAction::make('disabled') to change attribute, brand, category, or supplier visibility. These operations can break product variants and substantially disrupt storefront catalog visibility. Fixed in version 2.9.2.
Original NVD description (English source)
Shopper is a Headless e-commerce Admin Panel. In versions from 2.0.0 prior to 2.10.1 and in the 3.0.0 prereleases beta.1 and beta.2, authenticated back-office staff with a content-upload permission can store executable media on the administrator's own origin. In the 2.x implementation, relevant upload permissions include `edit_products` or `add_brands`, and `packages/admin/config/media.php` allows `image/svg+xml` in every media collection, including image fields whose image/* validation also accepts SVG. The product files collection in `packages/admin/src/Livewire/Components/Products/Form/Files.php` has no MIME restriction and accepts `text/html` as well. Media is served inline from the `public` disk under `/storage/` with its own content type, without `Content-Disposition: attachment` or a `Content-Security-Policy`. When an administrator opens an uploaded HTML or SVG file, stored script executes in that administrator's session. In 2.x, the script can invoke `packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php`, whose `store()` checks `access_setting` held by the viewing administrator but trusts client-supplied `role_id`, to create a new attacker-controlled administrator with a chosen password. This account persists after the uploaded file is deleted and gives access to customer data, orders, settings, and user/role management; the same script can exfiltrate data or grant permissions to the attacker's account. Direct account creation by the low-privileged uploader is blocked, so exploitation requires the administrator to open the file. The 3.x prerelease line already excludes SVG but still allows executable product files. This issue is fixed in versions 2.10.1 and 3.0.0-beta.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS