CVE-2026-47740: Shopper Admin Permission Bypass Enables Unauthorized Order Mutation and Payment Capture

Technical summary

The vulnerability stems from inadequate permission checks on Filament actions in the admin Order detail and Order shipments views. Specifically, actions such as cancel, markPaid, markComplete, capturePayment, archive, and startProcessing were guarded only by read_orders permission rather than the required edit_orders permission. Similarly, shipment actions (markDelivered, editTracking) checked only browse_orders instead of a more restrictive permission. The capturePayment action is particularly dangerous because it directly interfaces with payment service providers, allowing unauthenticated fund transfers to be initiated by unauthorized users. The flaw affects all versions prior to 2.8.0.

Business impact

This vulnerability directly threatens financial integrity and operational trust. An employee with minimal system access—or a compromised low-privilege account—could unilaterally modify order states, process refunds, charge customers without authorization, or disrupt fulfillment pipelines. The ability to trigger real payment captures means actual funds could be moved without proper authorization controls. Organizations relying on Shopper face potential revenue leakage, chargeback disputes, customer complaints, and audit findings related to segregation of duties and financial controls.

Affected systems

Shopper versions prior to 2.8.0 are affected. The vulnerability is present in all deployments of the headless e-commerce admin panel using versions before the fix. Organizations running Shopper should verify their current version immediately against the vendor's release notes.

Exploitability

Exploitation requires authentication (low-privilege user credentials) but no additional complexity. An attacker with a read-only account can directly invoke the vulnerable actions over the network without user interaction. The CVSS score of 8.1 (HIGH) reflects the combination of network accessibility, low privilege requirement, and high impact on both confidentiality and integrity. No exploit code or active weaponization is required beyond standard API calls or UI manipulation.

Remediation

Upgrade Shopper to version 2.8.0 or later immediately. This version implements proper permission enforcement, restricting order mutation actions to users holding edit_orders permission and shipment actions to users with appropriate administrative privileges. After patching, audit recent order modifications, payment captures, and shipment changes performed by read-only accounts to detect unauthorized activity.

Patch guidance

Apply Shopper 2.8.0 as a critical security update. Verify the update through official vendor release channels and changelogs before deployment. If version 2.8.0 is not yet available in your deployment environment, consult the vendor's security advisory for interim mitigations. Test the patch in a staging environment to ensure no business process disruption before rolling to production.

Detection guidance

Search your application logs for order mutation actions (cancel, markPaid, markComplete, capturePayment, archive, startProcessing, markDelivered, editTracking) performed by users holding only read_orders or browse_orders permissions. Cross-reference these actions with actual permission assignments in your access control system. Inspect payment capture logs for transactions initiated by non-administrative accounts. Monitor for unusual patterns of order state changes from low-privilege sessions. Implement real-time alerting on permission mismatches between user role and action severity.

Why prioritize this

This is a high-priority vulnerability requiring immediate remediation. The combination of financial impact (real payment captures), ease of exploitation (low-privilege authentication only), and broad applicability (all Shopper deployments pre-2.8.0) makes it critical. The vulnerability violates fundamental access control principles and creates direct exposure to revenue leakage and fraud. Any organization using Shopper should treat this as an emergency patch.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects: network-based attack vector (AV:N), low attack complexity (AC:L), low privilege requirement (PR:L), no user interaction needed (UI:N), and high impact on both confidentiality and integrity (C:H/I:H). The absence of availability impact (A:N) prevents a critical rating, but the ability to read and modify sensitive order data and trigger unauthorized financial transactions justifies the HIGH severity classification.

Frequently asked questions