CVE-2026-47740

Workarounds

None. Upgrade to v2.8.0.

Resources

• Pull request: https://github.com/shopperlabs/shopper/pull/511
• CWE-862 Missing Authorization
• CWE-285 Improper Authorization

Multiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:

• Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with read_orders only and did not require edit_orders. capturePayment could trigger an actual PSP capture.
• Order shipments table actions (mark delivered, edit tracking) were callable with browse_orders only.
• Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on store(), so any authenticated panel user could mutate product data without edit_products.
• Settings/Team/Index had no mount() authorization at all, any authenticated user could create roles and delete other users.
• Settings/Team/RolePermission gated its write actions on the read-only view_users permission, allowing privilege escalation via the RBAC system itself.
• PaymentMethods, Currencies, Carriers table toggles and per-record actions had no per-action permission check.
• Customers/Create::store() re-passed a Hidden _password form field into the create payload.

Several public Eloquent model properties on Livewire components were not #[Locked], allowing client-side ID tampering.

A stored XSS surface existed on the product barcode field, which is rendered through DNS1DFacade::getBarcodeHTML() with {!! !!}.

The application does not perform an authorization check before performing a sensitive operation. Typical impact: unauthorized access to restricted functionality or data.

CVE-2026-47740 has a CVSS score of 8.1 (High). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (2.8.0); upgrading removes the vulnerable code path.

Kodem intelligence

Fixed in v2.8.0. Upgrade via:

composer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8

php artisan migrate

1. What is CVE-2026-47740? CVE-2026-47740 is a high-severity missing authorization vulnerability in shopper/framework (composer), affecting versions < 2.8.0. It is fixed in 2.8.0. The application does not perform an authorization check before performing a sensitive operation.
2. How severe is CVE-2026-47740? CVE-2026-47740 has a CVSS score of 8.1 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of shopper/framework are affected by CVE-2026-47740? shopper/framework (composer) versions < 2.8.0 is affected.
4. Is there a fix for CVE-2026-47740? Yes. CVE-2026-47740 is fixed in 2.8.0. Upgrade to this version or later.
5. Is CVE-2026-47740 exploitable, and should I be worried? Whether CVE-2026-47740 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-47740 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-47740? Upgrade shopper/framework to 2.8.0 or later.