CVE-2026-47744

Workarounds

None. Upgrade to v2.8.0.

Two distinct authorization defects in the team settings allowed any authenticated panel user to take over the RBAC system:

• Settings/Team/Index had no mount() authorization. Any authenticated user could load the page and use its public actions to create new roles and delete other users, including administrators.
• Settings/Team/RolePermission gated its write actions on the read-only view_users permission. Any user holding view_users could grant themselves or any other user arbitrary permissions, including manage_users and edit_orders, effectively escalating to full panel administrator from a read-only account.

Combined, these two defects allow a low-privilege authenticated user to obtain administrator privileges and remove the legitimate administrators from the panel.

The application assigns, modifies, tracks, or checks privileges incorrectly, allowing a user to gain elevated access. Typical impact: privilege escalation beyond the intended level.

CVE-2026-47744 has a CVSS score of 9.9 (Critical). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (2.8.0); upgrading removes the vulnerable code path.

Kodem intelligence

Fixed in v2.8.0:

• Settings/Team/Index::mount() now authorizes against manage_users.
• Settings/Team/RolePermission write actions now require manage_users instead of view_users.

Upgrade via:

composer require shopper/admin:^2.8

1. What is CVE-2026-47744? CVE-2026-47744 is a critical-severity improper privilege management vulnerability in shopper/framework (composer), affecting versions < 2.8.0. It is fixed in 2.8.0. The application assigns, modifies, tracks, or checks privileges incorrectly, allowing a user to gain elevated access.
2. How severe is CVE-2026-47744? CVE-2026-47744 has a CVSS score of 9.9 (Critical). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of shopper/framework are affected by CVE-2026-47744? shopper/framework (composer) versions < 2.8.0 is affected.
4. Is there a fix for CVE-2026-47744? Yes. CVE-2026-47744 is fixed in 2.8.0. Upgrade to this version or later.
5. Is CVE-2026-47744 exploitable, and should I be worried? Whether CVE-2026-47744 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-47744 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-47744? Upgrade shopper/framework to 2.8.0 or later.