# CVE-2026-56828 - Shopper: read-only team permissions allow administrator creation and permission escalation

DevFeed: [CVE-2026-56828 - Shopper: read-only team permissions allow administrator creation and permission escalation](<https://devfeed.tech/articles/cve-2026-56828-shopper-read-only-team-permissions-allow-administrator-creation-and-permission-escalation-104696.md>)

Original publisher: [Read original article](<https://cvefeed.io/vuln/detail/CVE-2026-56828>)

Author: CVEFEED.io; github.com

Published: 2026-10-28T16:17:08Z

Content type: news

Language: en

Sources: [Latest High/Critical Vulnerabilitiy Feed](<https://devfeed.tech/sources/latest-high-critical-vulnerabilitiy-feed.md>)

Topics: [Authorization](<https://devfeed.tech/topics/authorization.md>), [permission](<https://devfeed.tech/topics/permission.md>), [rbac](<https://devfeed.tech/topics/rbac.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [admin](<https://devfeed.tech/tags/admin.md>), [administrator](<https://devfeed.tech/tags/administrator.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2026-56828](<https://devfeed.tech/tags/cve-2026-56828.md>), [e-commerce](<https://devfeed.tech/tags/e-commerce.md>), [permission](<https://devfeed.tech/tags/permission.md>), [permissions](<https://devfeed.tech/tags/permissions.md>), [privilege-escalation](<https://devfeed.tech/tags/privilege-escalation.md>), [rbac](<https://devfeed.tech/tags/rbac.md>), [roles](<https://devfeed.tech/tags/roles.md>), [team](<https://devfeed.tech/tags/team.md>), [users](<https://devfeed.tech/tags/users.md>), [version](<https://devfeed.tech/tags/version.md>)

## AI overview

Shopper versions 2.8.0 up to 2.8.1 have authorization gaps in three Livewire team-management components. A staff member with `view_users` and `access_dashboard` can grant or remove permissions, create a pre-verified administrator by selecting the admin role and setting a password, or delete removable roles, which can also revoke access for assigned users. The permission controls check `view_users` where `access_setting` is required, and role deletion lacks action-level authorization. The issue is fixed in version 2.8.1. The source reports severity 8.8 (HIGH); it lists no affected products.

## Source excerpt

CVE ID :CVE-2026-56828 Published : Oct. 28, 2026, 4:17 p.m. | 30 minutes ago Description :Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain authorization gaps after the earlier team-settings authorization fix. A staff member with only `view_users` and `access_dashboard` can mutate permissions, create an administrator, or delete roles. In `packages/admin/src/Livewire/Components/Settings/Team/Permissions.php`, `togglePermission` and `removePermission` authorize `view_users` rather than the stronger `access_setting` permission; `packages/admin/resources/views/livewire/components/settings/team/permissions.blade.php` exposes permission IDs in `wire:click` handlers. The attacker can grant arbitrary permissions to the bound role, including `access_setting` on the attacker's own role, or delete permission definitions. In `packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php`, `mount()` and `store()` also accept `view_users`, and the client-selected `role_id` can identify the admin role, allowing creation of a pre-verified administrator with an attacker-chosen password. In `packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php`, `deleteAction` has no action authorization and is only conditioned on `can_be_removed`, while page access requires `view_users`. Deleting a removable role removes access for assigned users, enabling RBAC denial of service as well as privilege escalation. This issue is fixed in version 2.8.1. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...