{"id":"CVE-2026-62991","title":"Shopper: customer detail IDOR exposes administrator and staff records","summary":"Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route `/cpanel/customers/{user}/show` in `packages/admin/src/Livewire/Pages/Customers/Show.php` checks `read_customers` but looks up an arbitrary user ID …","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-639"],"vendor":"shopperlabs","product":"shopper","affected":["shopper < 2.10.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-02T17:03:21.720623Z"},"published":"2026-10-30","updated":"2026-11-02","sourceUpdated":"2026-11-02T18:10:19.747Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-62991","references":[{"url":"https://github.com/shopperlabs/shopper/security/advisories/GHSA-w7mm-g5pr-gpff","label":"https://github.com/shopperlabs/shopper/security/advisories/GHSA-w7mm-g5pr-gpff"},{"url":"https://github.com/shopperlabs/shopper/pull/594","label":"https://github.com/shopperlabs/shopper/pull/594"},{"url":"https://github.com/shopperlabs/shopper/commit/14a28c5141574b0edb0f7ff261fbe449cd10b903","label":"https://github.com/shopperlabs/shopper/commit/14a28c5141574b0edb0f7ff261fbe449cd10b903"},{"url":"https://github.com/shopperlabs/shopper/releases/tag/v2.10.1","label":"https://github.com/shopperlabs/shopper/releases/tag/v2.10.1"}],"tags":["cve.org"],"epss":0.00238,"epssPercentile":0.15023,"ingestedAt":"2026-11-05T19:30:42.768Z","slug":"CVE-2026-62991","body":"## Overview\n\nShopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route `/cpanel/customers/{user}/show` in `packages/admin/src/Livewire/Pages/Customers/Show.php` checks `read_customers` but looks up an arbitrary user ID without applying the `customers` role scope used by the listing. Authenticated staff holding `access_dashboard` and `read_customers` can change the user ID to retrieve administrator or staff profiles despite lacking `view_users`, which protects the separate team-management interface. The flaw exposes account profile data and permits user-ID enumeration through differing success, denial, and not-found responses. If the same role also holds `delete_customers`, `anonymizeAction()` operates on the unrestricted loaded user model and can enable destructive follow-up against non-customer accounts. This issue is fixed in version 2.10.1.\n\n## Affected\n\n- `shopper < 2.10.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}