CVE-2026-114387: Shopper: missing authorization allows admin escalation

HIGH

Published October 21, 2026

CISO Take

Shopper, a Laravel/Livewire e-commerce admin framework, has a missing authorization flaw (CWE-862) in versions 2.0.0 up to 2.6.0. Any admin-panel user holding only the access_dashboard permission can call CreateTeamMember::store() or Permissions::togglePermission() directly over /livewire/update, create administrator accounts and grant themselves full permissions. The CVSS is 8.8 (network, low complexity, low privileges, no user interaction). No EPSS score, public exploit, Nuclei template or CISA KEV listing exists yet, and the package is not a recognized AI/ML component, so the 'ml_ui' category looks like a misclassification and AI-specific blast radius is minimal. Exposure is limited to organizations running Shopper, including any that use it as a storefront or back office around AI products. Upgrade to Shopper 2.6.0 or later, then audit admin and team-member accounts and permission grants for unexpected changes.

Sources:NVDVulnCheckGitHub (shopperlabs/shopper)ATLAS

What is the risk?

Overall risk is high for Shopper deployments, but low for AI/ML-specific exposure. Exploitation needs an authenticated low-privilege admin-panel account, is trivial once that is obtained, and gives full administrative takeover with high confidentiality, integrity and availability impact. There is no known exploitation, public exploit or EPSS data, and the relevant source code is public, so reproduction is straightforward. Confidence that this is an AI/ML issue is LOW; confidence in the vulnerability details is HIGH (vendor patch and third-party advisory).

How does the attack unfold?

Initial Access

Attacker holds or obtains a low-privilege admin-panel account with only access_dashboard.

AML.T0012

Exploitation

Attacker calls CreateTeamMember::store() or Permissions::togglePermission() directly via /livewire/update, bypassing missing authorization checks.

AML.T0049

Privilege Escalation

A new administrator account is created or the attacker's own account is granted all permissions.

Impact

Full administrator control allows access to customer data, configuration changes and persistent backdoor accounts.

Initial Access

Attacker holds or obtains a low-privilege admin-panel account with only access_dashboard.

AML.T0012

Exploitation

Attacker calls CreateTeamMember::store() or Permissions::togglePermission() directly via /livewire/update, bypassing missing authorization checks.

AML.T0049

Privilege Escalation

A new administrator account is created or the attacker's own account is granted all permissions.

Impact

Full administrator control allows access to customer data, configuration changes and persistent backdoor accounts.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
shopper	—	—	No patch

Do you use shopper? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 25% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade Shopper to 2.6.0 or later (see release v2.6.0 and commit d1ac6cee). 2) Until patched, restrict access to the admin panel by network (VPN or IP allowlist) and remove access_dashboard from users who do not need it. 3) Review all administrator and team-member accounts and permission changes since deployment of 2.0.0 and revoke unexpected ones. 4) Monitor web logs for POST requests to /livewire/update from low-privilege sessions that coincide with new admin creation or permission toggles. 5) Rotate secrets and API keys reachable by administrators if suspicious admin creation is found.

How is it classified?

Auth BypassFrameworkAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to risks and deployed system incidents

Frequently Asked Questions

What is CVE-2026-114387?

Is CVE-2026-114387 actively exploited?

No confirmed active exploitation of CVE-2026-114387 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-114387?

1) Upgrade Shopper to 2.6.0 or later (see release v2.6.0 and commit d1ac6cee). 2) Until patched, restrict access to the admin panel by network (VPN or IP allowlist) and remove access_dashboard from users who do not need it. 3) Review all administrator and team-member accounts and permission changes since deployment of 2.0.0 and revoke unexpected ones. 4) Monitor web logs for POST requests to /livewire/update from low-privilege sessions that coincide with new admin creation or permission toggles. 5) Rotate secrets and API keys reachable by administrators if suspicious admin creation is found.

What systems are affected by CVE-2026-114387?

This vulnerability affects the following AI/ML architecture patterns: Web admin panels, Laravel/Livewire applications, E-commerce back offices.

What is the CVSS score for CVE-2026-114387?

CVE-2026-114387 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.32%.

What is the AI security impact?

Affected AI Architectures

Web admin panelsLaravel/Livewire applicationsE-commerce back offices

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store() or Permissions::togglePermission() directly over /livewire/update to create admin accounts and escalate to full administrator.

Exploitation Scenario

An attacker obtains or is given a low-privilege admin-panel account that holds only access_dashboard, for example a contractor or a phished employee. They craft a Livewire update request to /livewire/update that invokes CreateTeamMember::store() to create a new account with the administrator role, or call Permissions::togglePermission() to grant their own account every permission. They then log in as a full administrator, extract customer and configuration data, create persistent backdoor admin accounts and alter store settings or integrations. If the store fronts an AI product or service, the attacker can tamper with its content and credentials.

Weaknesses (CWE)

CWE-862Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.