CVE-2026-114387High· 8.8▾ TwilightShopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store() or Pe…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store() or Permissions::togglePermission() directly over /livewire/update to create admin accounts and escalate to full administrator.
shopper >= 2.0.0 < 2.6.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-56825High· 8.1Shopper is a Headless e-commerce Admin Panel
CVE-2026-56827High· 8.1Shopper is a Headless e-commerce Admin Panel
CVE-2026-56829High· 8.1Shopper is a Headless e-commerce Admin Panel
CVE-2026-56830Medium· 6.5Shopper is a Headless e-commerce Admin Panel
CVE-2026-56831Medium· 6.5Shopper is a Headless e-commerce Admin Panel
CVE-2025-12924Medium· 4.3A vulnerability was identified in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224