GHSA-j328-xmgp-j4q3: Shopper: privilege escalation via improper Livewire admin component authorization
Summary
Three admin components in Shopper v2.8.0 incorrectly use the read-only `view_users` permission to gate sensitive actions instead of the `access_setting` permission. A staff member with only `view_users` permission can escalate privileges by granting themselves permissions, creating new admin accounts, or deleting roles, because the authorization checks (the permission verification step that controls who can perform actions) were misclassified.
Solution / Mitigation
Change `$this->authorize('view_users')` to `$this->authorize('access_setting')` in the following files: `Permissions::togglePermission()` and `Permissions::removePermission()` in `packages/admin/src/Livewire/Components/Settings/Team/Permissions.php`, `CreateTeamMember::mount()` and `CreateTeamMember::store()` in `packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php`, and add an `->authorize('access_setting')` check to the `deleteAction` in `packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php`.
Vulnerability Details
EPSS: 0.0%
Yes
September 11, 2026
Classification
Affected Packages
Original source: https://github.com/advisories/GHSA-j328-xmgp-j4q3
First tracked: September 11, 2026 at 08:00 PM
Classified by LLM (prompt v3) · confidence: 95%