Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.new Create a CVE report
Check your stack
CVE-2026-62991medium6.5

Shopper: customer detail IDOR exposes administrator and staff records

Impact

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route /cpanel/customers/{user}/show in packages/admin/src/Livewire/Pages/Customers/Show.php checks read_customers but looks up an arbitrary user ID without applying the customers role scope used by the listing. Authenticated staff holding access_dashboard and read_customers can change the user ID to retrieve administrator or staff profiles despite lacking view_users, which protects the separate team-management interface. The flaw exposes account profile data and permits user-ID enumeration through differing…

Source excerpt · GitHub_M

Affected packages

This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.

Affected products

Vendor version evidence. Product records are separate from automatic dependency matching.

shopperlabs · GitHub_M

shopper

1 range
GitHub_M version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

< 2.10.1

unaffected

unknown

Other versions: unknown

Original source description

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route /cpanel/customers/{user}/show in packages/admin/src/Livewire/Pages/Customers/Show.php checks read_customers but looks up an arbitrary user ID without applying the customers role scope used by the listing. Authenticated staff holding access_dashboard and read_customers can change the user ID to retrieve administrator or staff profiles despite lacking view_users, which protects the separate team-management interface. The flaw exposes account profile data and permits user-ID enumeration through differing success, denial, and not-found responses. If the same role also holds delete_customers, anonymizeAction() operates on the unrestricted loaded user model and can enable destructive follow-up against non-customer accounts. This issue is fixed in version 2.10.1.

Inside the record

Evidence available

Package identity · not supplied
Version evidence
Remediation guidance · not supplied
Weakness classification
Additional publishers · not supplied

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-62991

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Underlying weaknesses

The source’s classification of what caused the vulnerability.

CWE-639 ↗

CWE-639: Authorization Bypass Through User-Controlled Key

GitHub_M

Related →
Contributing organizations · 1
GitHub_M

Assigning organization

2026-10-30

What changed

Follow changes
No substantive changes have been recorded here yet. History starts when cve.new observes a change after tracking is enabled; earlier edits are not reconstructed.

Large field values are marked as truncated previews. Original source snapshots remain retained.

References

4 sources
github.com/shopperlabs/shopper/security/advisories/GHSA-w7mm-g5pr-gpff
Security advisoryGitHub_M
github.com/shopperlabs/shopper/pull/594
PatchGitHub_M
github.com/shopperlabs/shopper/commit/14a28c5141574b0edb0f7ff261fbe449cd10b903
PatchGitHub_M
github.com/shopperlabs/shopper/releases/tag/v2.10.1
Release notesGitHub_M