CVE-2026-47740: Shopper: Authorization bypass in multiple Livewire admin components

Synopsis

Authorization bypass in multiple Livewire admin components of Shopper, a headless e-commerce admin panel. The flaw is reachable over the network by any authenticated low-privilege user with read-only order permissions, who can then invoke order mutation actions (cancel, mark paid, mark complete, capture payment, archive, start processing, mark delivered, edit tracking) that should require edit_orders. Successful exploitation lets a read-only user alter the lifecycle of every order and trigger real payment captures against the configured PSP. A patched-image rebuild at Shopper 2.8.0 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Shopper admin panel over the network (AV:N).

• AuthenticationRequired

  Any low-privilege authenticated account with read_orders or browse_orders is sufficient (PR:L).

• Victim interactionNot required

  No victim action is needed; the attacker invokes the Livewire actions directly (UI:N).

• Attack complexityDetail

  Attack complexity is low: the vulnerable actions are reliably callable without environmental preconditions (AC:L).

Blast Radius

• Alters the lifecycle of any order in the panel by invoking cancel, mark paid, mark complete, archive, or start processing.
• Triggers a real payment capture through the configured PSP via capturePayment, causing actual funds movement.
• Modifies shipment state through mark delivered and edit tracking, corrupting fulfillment records.
• Reads order detail data exposed through the same admin views, disclosing customer order contents.