---
id: CVE-2026-62991
title: 'Shopper: customer detail IDOR exposes administrator and staff records'
summary: >-
  Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer
  detail route `/cpanel/customers/{user}/show` in
  `packages/admin/src/Livewire/Pages/Customers/Show.php` checks `read_customers`
  but looks up an arbitrary user ID …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: shopperlabs
product: shopper
affected:
  - shopper < 2.10.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-02T17:03:21.720623Z'
published: '2026-10-30'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T18:10:19.747Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-62991'
references:
  - url: >-
      https://github.com/shopperlabs/shopper/security/advisories/GHSA-w7mm-g5pr-gpff
    label: >-
      https://github.com/shopperlabs/shopper/security/advisories/GHSA-w7mm-g5pr-gpff
  - url: 'https://github.com/shopperlabs/shopper/pull/594'
    label: 'https://github.com/shopperlabs/shopper/pull/594'
  - url: >-
      https://github.com/shopperlabs/shopper/commit/14a28c5141574b0edb0f7ff261fbe449cd10b903
    label: >-
      https://github.com/shopperlabs/shopper/commit/14a28c5141574b0edb0f7ff261fbe449cd10b903
  - url: 'https://github.com/shopperlabs/shopper/releases/tag/v2.10.1'
    label: 'https://github.com/shopperlabs/shopper/releases/tag/v2.10.1'
tags:
  - cve.org
epss: 0.00238
epssPercentile: 0.15023
ingestedAt: '2026-11-05T19:30:42.768Z'
---

## Overview

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route `/cpanel/customers/{user}/show` in `packages/admin/src/Livewire/Pages/Customers/Show.php` checks `read_customers` but looks up an arbitrary user ID without applying the `customers` role scope used by the listing. Authenticated staff holding `access_dashboard` and `read_customers` can change the user ID to retrieve administrator or staff profiles despite lacking `view_users`, which protects the separate team-management interface. The flaw exposes account profile data and permits user-ID enumeration through differing success, denial, and not-found responses. If the same role also holds `delete_customers`, `anonymizeAction()` operates on the unrestricted loaded user model and can enable destructive follow-up against non-customer accounts. This issue is fixed in version 2.10.1.

## Affected

- `shopper < 2.10.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.