GHSA-f946-9qp6-vgchhigh8.1

shopper/framework: Authorization bypass in multiple Livewire admin components

The advisory, in context

Impact

Multiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:

Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with read_orders only and did not require edit_orders. capturePayment could trigger an actual PSP capture.
Order shipments table actions (mark delivered, edit tracking) were callable with browse_orders only.
Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on store(), so any authenticated panel user could mutate product data without edit_products.
Settings/Team/Index had no mount() authorization at all — any authenticated user could create roles and delete other users.
Settings/Team/RolePermission gated its write actions on the read-only view_users permission, allowing privilege escalation via the RBAC system itself.
PaymentMethods, Currencies, Carriers table toggles and per-record actions had no per-action permission check.
Customers/Create::store() re-passed a Hidden _password form field into the create payload.

Several public Eloquent model properties on Livewire components were not #[Locked], allowing client-side ID tampering.

A stored XSS surface existed on the product barcode field, which is rendered through DNS1DFacade::getBarcodeHTML() with {!! !!}.

Patches

Fixed in v2.8.0. Upgrade via:

composer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8

php artisan migrate

Workarounds

None. Upgrade to v2.8.0.

Resources

Pull request: https://github.com/shopperlabs/shopper/pull/511
CWE-862 Missing Authorization
CWE-285 Improper Authorization

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

shopper/framework Packagist

Ecosystem versions

Earlier releases before 2.8.0

Fixed in 2.8.0

59 explicitly affected versions

v2.0.0, v2.0.0-alpha, v2.0.0-beta, v2.0.0-beta10, v2.0.0-beta11, v2.0.0-beta12, v2.0.0-beta13, v2.0.0-beta14, v2.0.0-beta15, v2.0.0-beta16, v2.0.0-beta17, v2.0.0-beta18, v2.0.0-beta19, v2.0.0-beta2, v2.0.0-beta20, v2.0.0-beta21, v2.0.0-beta3, v2.0.0-beta4, v2.0.0-beta5, v2.0.0-beta6, v2.0.0-beta7, v2.0.0-beta8, v2.0.0-beta9, v2.0.1, v2.0.2, v2.0.3, v2.1.1, v2.1.2, v2.1.3, v2.1.4, v2.1.5, v2.1.6, v2.2, v2.2.1, v2.2.2, v2.2.3, v2.2.4, v2.2.5, v2.2.6, v2.2.7, v2.3, v2.3.1, v2.3.2, v2.3.3, v2.4.0, v2.4.1, v2.4.2, v2.4.3, v2.5.0, v2.5.1, v2.6.0, v2.6.1, v2.6.2, v2.6.3, v2.6.4, v2.7.0, v2.7.1, v2.7.2, v2.7.3

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "2.8.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v2.0.0",
    "v2.0.0-alpha",
    "v2.0.0-beta",
    "v2.0.0-beta10",
    "v2.0.0-beta11",
    "v2.0.0-beta12",
    "v2.0.0-beta13",
    "v2.0.0-beta14",
    "v2.0.0-beta15",
    "v2.0.0-beta16",
    "v2.0.0-beta17",
    "v2.0.0-beta18",
    "v2.0.0-beta19",
    "v2.0.0-beta2",
    "v2.0.0-beta20",
    "v2.0.0-beta21",
    "v2.0.0-beta3",
    "v2.0.0-beta4",
    "v2.0.0-beta5",
    "v2.0.0-beta6",
    "v2.0.0-beta7",
    "v2.0.0-beta8",
    "v2.0.0-beta9",
    "v2.0.1",
    "v2.0.2",
    "v2.0.3",
    "v2.1.1",
    "v2.1.2",
    "v2.1.3",
    "v2.1.4",
    "v2.1.5",
    "v2.1.6",
    "v2.2",
    "v2.2.1",
    "v2.2.2",
    "v2.2.3",
    "v2.2.4",
    "v2.2.5",
    "v2.2.6",
    "v2.2.7",
    "v2.3",
    "v2.3.1",
    "v2.3.2",
    "v2.3.3",
    "v2.4.0",
    "v2.4.1",
    "v2.4.2",
    "v2.4.3",
    "v2.5.0",
    "v2.5.1",
    "v2.6.0",
    "v2.6.1",
    "v2.6.2",
    "v2.6.3",
    "v2.6.4",
    "v2.7.0",
    "v2.7.1",
    "v2.7.2",
    "v2.7.3"
  ]
}

Set up in your agent.

Investigate in your agent.