https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 19:45:40 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-322943 EUVD-2026-322943 https://cve.radiocsirt.org/vuln/euvd-2026-322943 https://cve.radiocsirt.org/vuln/fkie_cve-2026-47745 <p>Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, the admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could disable every payment method on the store, disable or alter the default currency, or disable carriers. The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user. This vulnerability is fixed in 2.8.0.</p> <p>Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, the admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could disable every payment method on the store, disable or alter the default currency, or disable carriers. The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user. This vulnerability is fixed in 2.8.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-47745 https://cve.radiocsirt.org/vuln/ghsa-fxqw-97cc-7g5c <p><strong>Affected:</strong> Packagist: shopper/framework</p> <p>## Impact</p> <p>The admin tables for `PaymentMethods`, `Currencies` and `Carriers` exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could:</p> <p>- Disable every payment method on the store, blocking checkout. - Disable or alter the default currency, changing displayed prices and the exchange rate basis. - Disable carriers, breaking shipping rate computation at checkout.</p> <p>The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user.</p> <p>## Patches</p> <p>Fixed in `v2.8.0`. Each toggle and per-record action now requires its matching permission (`edit_payment_methods`, `edit_currencies`, `edit_carriers`).</p> <p>Upgrade via:</p> <p>```bash composer require shopper/admin:^2.8 ```</p> <p>## Workarounds</p> <p>None. Upgrade to `v2.8.0`.</p> <p><strong>Affected:</strong> Packagist: shopper/framework</p> <p>## Impact</p> <p>The admin tables for `PaymentMethods`, `Currencies` and `Carriers` exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could:</p> <p>- Disable every payment method on the store, blocking checkout. - Disable or alter the default currency, changing displayed prices and the exchange rate basis. - Disable carriers, breaking shipping rate computation at checkout.</p> <p>The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user.</p> <p>## Patches</p> <p>Fixed in `v2.8.0`. Each toggle and per-record action now requires its matching permission (`edit_payment_methods`, `edit_currencies`, `edit_carriers`).</p> <p>Upgrade via:</p> <p>```bash composer require shopper/admin:^2.8 ```</p> <p>## Workarounds</p> <p>None. Upgrade to `v2.8.0`.</p> https://cve.radiocsirt.org/vuln/ghsa-fxqw-97cc-7g5c