CVE-2026-47744: Shopper: Authorization bypass and RBAC privilege escalation in team settings

Synopsis

Authorization bypass and RBAC privilege escalation in Shopper, a headless e-commerce admin panel, where two flaws in the team settings let any authenticated panel user take over the role-based access control system. The bugs are reachable over the network by anyone with a low-privilege account and require no victim interaction: the Settings/Team/Index page lacks a mount() authorization check, and the Settings/Team/RolePermission writes are gated on the read-only view_users permission. Successful exploitation lets a low-privilege user create roles, grant themselves manage_users and edit_orders, and delete legitimate administrators, taking full control of the panel. The description states a fix landed in 2.8.0; a patched-image rebuild at that version is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Shopper admin panel over the network (AV:N).

• AuthenticationRequired

  Any low-privilege authenticated panel account is sufficient; even a read-only user holding view_users can trigger the escalation (PR:L).

• Victim interactionNot required

  No administrator or other user needs to click or approve anything for exploitation (UI:N).

• Attack complexityDetail

  Exploitation is reliable and condition-free, requiring only standard panel actions (AC:L).

Blast Radius

• Creates arbitrary roles and grants manage_users, edit_orders, and other administrative permissions to any account.
• Deletes existing users including legitimate administrators, locking them out of the panel.
• Reads and modifies customer records, orders, and other data accessible to a full panel administrator.
• Disrupts availability of the admin panel by removing administrators and reshaping the RBAC configuration.