Most recent entries from all

EUVD-2026-322943

2026-10-08T19:46:18.292981+00:00

EUVD-2026-322943

fkie_cve-2026-47745

2026-10-08T19:46:18.293014+00:00

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, the admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could disable every payment method on the store, disable or alter the default currency, or disable carriers. The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user. This vulnerability is fixed in 2.8.0.

GHSA-fxqw-97cc-7g5c — Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables

2026-10-08T19:46:18.293047+00:00

Affected: Packagist: shopper/framework

## Impact

The admin tables for `PaymentMethods`, `Currencies` and `Carriers` exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could:

- Disable every payment method on the store, blocking checkout. - Disable or alter the default currency, changing displayed prices and the exchange rate basis. - Disable carriers, breaking shipping rate computation at checkout.

The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user.

## Patches

Fixed in `v2.8.0`. Each toggle and per-record action now requires its matching permission (`edit_payment_methods`, `edit_currencies`, `edit_carriers`).

Upgrade via:

```bash composer require shopper/admin:^2.8 ```

## Workarounds

None. Upgrade to `v2.8.0`.