{"id":"CVE-2026-62991","aliases":[],"cve":{"records":[{"id":"CVE-2026-62991","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-14T23:10:57.031Z","published":"2026-10-30T21:07:04.473Z","modified":"2026-10-30T21:07:04.473Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-30T21:07:04.473Z"}],"references":[{"url":"https://github.com/shopperlabs/shopper/security/advisories/GHSA-w7mm-g5pr-gpff","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/shopperlabs/shopper/pull/594","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/shopperlabs/shopper/commit/14a28c5141574b0edb0f7ff261fbe449cd10b903","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/shopperlabs/shopper/releases/tag/v2.10.1","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-639","description":"CWE-639: Authorization Bypass Through User-Controlled Key","source":"GitHub_M"}],"applicability":[],"prioritization":[]},"title":"Shopper: customer detail IDOR exposes administrator and staff records","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route `/cpanel/customers/{user}/show` in `packages/admin/src/Livewire/Pages/Customers/Show.php` checks `read_customers` but looks up an arbitrary user ID without applying the `customers` role scope used by the listing. Authenticated staff holding `access_dashboard` and `read_customers` can change the user ID to retrieve administrator or staff profiles despite lacking `view_users`, which protects the separate team-management interface. The flaw exposes account profile data and permits user-ID enumeration through differing success, denial, and not-found responses. If the same role also holds `delete_customers`, `anonymizeAction()` operates on the unrestricted loaded user model and can enable destructive follow-up against non-customer accounts. This issue is fixed in version 2.10.1.","score":6.5,"severity":"medium","published":"2026-10-30T21:07:04.473Z","modified":"2026-10-30T21:07:04.473Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"shopperlabs","name":"shopper","platforms":[],"versions":[{"version":"< 2.10.1","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-62991"}],"remediation":[],"references":["https://github.com/shopperlabs/shopper/security/advisories/GHSA-w7mm-g5pr-gpff","https://github.com/shopperlabs/shopper/pull/594","https://github.com/shopperlabs/shopper/commit/14a28c5141574b0edb0f7ff261fbe449cd10b903","https://github.com/shopperlabs/shopper/releases/tag/v2.10.1"],"sources":[{"name":"CVE","id":"CVE-2026-62991","modified":"2026-10-30T21:07:04.473Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-62991"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5}],"sourceAffected":[],"observedAt":"2026-10-30T21:32:06.065Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T04:20:32.721Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T21:35:35.506Z","attemptedAt":"2026-10-30T21:35:35.506Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T21:35:35.626Z","attemptedAt":"2026-10-30T21:35:35.626Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-10-30T21:35:35.440Z","attemptedAt":"2026-10-30T21:35:35.440Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T21:35:35.077Z","attemptedAt":"2026-10-30T21:35:35.077Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-62991","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62991","modified":"2026-10-30T21:17:16.310","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-10-30T21:35:35.506Z"}],"aiSummary":null}