CVE-2026-56828

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-56828", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-23T14:55:09.117Z", "datePublished": "2026-10-28T15:40:39.294Z", "dateUpdated": "2026-11-03T13:06:24.272Z"}, "containers": {"cna": {"title": "Shopper: read-only team permissions allow administrator creation and permission escalation", "problemTypes": [{"descriptions": [{"cweId": "CWE-285", "lang": "en", "description": "CWE-285: Improper Authorization", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-j328-xmgp-j4q3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-j328-xmgp-j4q3"}, {"name": "https://github.com/shopperlabs/shopper/pull/514", "tags": ["x_refsource_MISC"], "url": "https://github.com/shopperlabs/shopper/pull/514"}, {"name": "https://github.com/shopperlabs/shopper/commit/ac9a76044a8e4a2b570b438d66cf3007f3dc479e", "tags": ["x_refsource_MISC"], "url": "https://github.com/shopperlabs/shopper/commit/ac9a76044a8e4a2b570b438d66cf3007f3dc479e"}, {"name": "https://github.com/shopperlabs/shopper/compare/v2.8.1...v2.9.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/shopperlabs/shopper/compare/v2.8.1...v2.9.2"}, {"name": "https://github.com/shopperlabs/shopper/releases/tag/v2.8.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/shopperlabs/shopper/releases/tag/v2.8.1"}], "affected": [{"vendor": "shopperlabs", "product": "shopper", "versions": [{"version": ">= 2.8.0, < 2.8.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T15:40:39.294Z"}, "descriptions": [{"lang": "en", "value": "Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain authorization gaps after the earlier team-settings authorization fix. A staff member with only `view_users` and `access_dashboard` can mutate permissions, create an administrator, or delete roles. In `packages/admin/src/Livewire/Components/Settings/Team/Permissions.php`, `togglePermission` and `removePermission` authorize `view_users` rather than the stronger `access_setting` permission; `packages/admin/resources/views/livewire/components/settings/team/permissions.blade.php` exposes permission IDs in `wire:click` handlers. The attacker can grant arbitrary permissions to the bound role, including `access_setting` on the attacker's own role, or delete permission definitions. In `packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php`, `mount()` and `store()` also accept `view_users`, and the client-selected `role_id` can identify the admin role, allowing creation of a pre-verified administrator with an attacker-chosen password. In `packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php`, `deleteAction` has no action authorization and is only conditioned on `can_be_removed`, while page access requires `view_users`. Deleting a removable role removes access for assigned users, enabling RBAC denial of service as well as privilege escalation. This issue is fixed in version 2.8.1."}], "source": {"advisory": "GHSA-j328-xmgp-j4q3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-03T13:06:00.958748Z", "id": "CVE-2026-56828", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T13:06:24.272Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-56828", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-03T13:06:00.958748Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T13:06:16.756Z"}}], "cna": {"title": "Shopper: read-only team permissions allow administrator creation and permission escalation", "source": {"advisory": "GHSA-j328-xmgp-j4q3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "shopperlabs", "product": "shopper", "versions": [{"status": "affected", "version": ">= 2.8.0, < 2.8.1"}]}], "references": [{"url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-j328-xmgp-j4q3", "name": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-j328-xmgp-j4q3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/shopperlabs/shopper/pull/514", "name": "https://github.com/shopperlabs/shopper/pull/514", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/shopperlabs/shopper/commit/ac9a76044a8e4a2b570b438d66cf3007f3dc479e", "name": "https://github.com/shopperlabs/shopper/commit/ac9a76044a8e4a2b570b438d66cf3007f3dc479e", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/shopperlabs/shopper/compare/v2.8.1...v2.9.2", "name": "https://github.com/shopperlabs/shopper/compare/v2.8.1...v2.9.2", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/shopperlabs/shopper/releases/tag/v2.8.1", "name": "https://github.com/shopperlabs/shopper/releases/tag/v2.8.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain authorization gaps after the earlier team-settings authorization fix. A staff member with only `view_users` and `access_dashboard` can mutate permissions, create an administrator, or delete roles. In `packages/admin/src/Livewire/Components/Settings/Team/Permissions.php`, `togglePermission` and `removePermission` authorize `view_users` rather than the stronger `access_setting` permission; `packages/admin/resources/views/livewire/components/settings/team/permissions.blade.php` exposes permission IDs in `wire:click` handlers. The attacker can grant arbitrary permissions to the bound role, including `access_setting` on the attacker's own role, or delete permission definitions. In `packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php`, `mount()` and `store()` also accept `view_users`, and the client-selected `role_id` can identify the admin role, allowing creation of a pre-verified administrator with an attacker-chosen password. In `packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php`, `deleteAction` has no action authorization and is only conditioned on `can_be_removed`, while page access requires `view_users`. Deleting a removable role removes access for assigned users, enabling RBAC denial of service as well as privilege escalation. This issue is fixed in version 2.8.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285: Improper Authorization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T15:40:39.294Z"}}}, "cveMetadata": {"cveId": "CVE-2026-56828", "state": "PUBLISHED", "dateUpdated": "2026-11-03T13:06:24.272Z", "dateReserved": "2026-06-23T14:55:09.117Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-28T15:40:39.294Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "shopper", "vendor": "shopperlabs", "versions": [{"status": "affected", "version": ">= 2.8.0, < 2.8.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain authorization gaps after the earlier team-settings authorization fix. A staff member with only `view_users` and `access_dashboard` can mutate permissions, create an administrator, or delete roles. In `packages/admin/src/Livewire/Components/Settings/Team/Permissions.php`, `togglePermission` and `removePermission` authorize `view_users` rather than the stronger `access_setting` permission; `packages/admin/resources/views/livewire/components/settings/team/permissions.blade.php` exposes permission IDs in `wire:click` handlers. The attacker can grant arbitrary permissions to the bound role, including `access_setting` on the attacker's own role, or delete permission definitions. In `packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php`, `mount()` and `store()` also accept `view_users`, and the client-selected `role_id` can identify the admin role, allowing creation of a pre-verified administrator with an attacker-chosen password. In `packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php`, `deleteAction` has no action authorization and is only conditioned on `can_be_removed`, while page access requires `view_users`. Deleting a removable role removes access for assigned users, enabling RBAC denial of service as well as privilege escalation. This issue is fixed in version 2.8.1."}, {"lang": "es", "value": "Shopper es un Panel de Administraci\u00f3n de comercio electr\u00f3nico Headless. Desde la versi\u00f3n 2.8.0 hasta la 2.8.1 incluida, tres componentes de administraci\u00f3n de Shopper Livewire conservan lagunas de autorizaci\u00f3n despu\u00e9s de la correcci\u00f3n de autorizaci\u00f3n de configuraci\u00f3n de equipo anterior. Un miembro del personal con solo \u2019view_users\u2019 y \u2019access_dashboard\u2019 puede modificar permisos, crear un administrador o eliminar roles. En \u2019packages/admin/src/Livewire/Components/Settings/Team/Permissions.php\u2019, \u2019togglePermission\u2019 y \u2019removePermission\u2019 autorizan \u2019view_users\u2019 en lugar del permiso m\u00e1s fuerte \u2019access_setting\u2019; \u2019packages/admin/resources/views/livewire/components/settings/team/permissions.blade.php\u2019 expone los ID de permiso en los manejadores \u2019wire:click\u2019. El atacante puede otorgar permisos arbitrarios al rol vinculado, incluyendo \u2019access_setting\u2019 en el propio rol del atacante, o eliminar definiciones de permisos. En \u2019packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php\u2019, \u2019mount()\u2019 y \u2019store()\u2019 tambi\u00e9n aceptan \u2019view_users\u2019, y el \u2019role_id\u2019 seleccionado por el cliente puede identificar el rol de administrador, permitiendo la creaci\u00f3n de un administrador preverificado con una contrase\u00f1a elegida por el atacante. En \u2019packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php\u2019, \u2019deleteAction\u2019 no tiene autorizaci\u00f3n de acci\u00f3n y solo est\u00e1 condicionado por \u2019can_be_removed\u2019, mientras que el acceso a la p\u00e1gina requiere \u2019view_users\u2019. Eliminar un rol removible elimina el acceso para los usuarios asignados, lo que permite la denegaci\u00f3n de servicio RBAC, as\u00ed como la escalada de privilegios. Este problema se ha solucionado en la versi\u00f3n 2.8.1."}], "id": "CVE-2026-56828", "lastModified": "2026-11-04T23:10:00.223", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-56828", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-03T13:06:00.958748Z", "version": "2.0.3"}}]}, "published": "2026-10-28T16:17:08.220", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/shopperlabs/shopper/commit/ac9a76044a8e4a2b570b438d66cf3007f3dc479e"}, {"source": "security-advisories@github.com", "url": "https://github.com/shopperlabs/shopper/compare/v2.8.1...v2.9.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/shopperlabs/shopper/pull/514"}, {"source": "security-advisories@github.com", "url": "https://github.com/shopperlabs/shopper/releases/tag/v2.8.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-j328-xmgp-j4q3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}, {"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.8.0,2.8.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "shopper", "source": "cna", "vendor": "shopperlabs"}, "product": "shopper", "vendor": "shopperlabs"}], "created": "2026-10-28T16:30:15.572726+00:00", "updated": "2026-10-28T16:30:15.959922+00:00", "vendors": ["shopperlabs", "shopperlabs$PRODUCT$shopper"]}