CVE-2026-47740
- Source
- https://cve.org/CVERecord?id=CVE-2026-47740
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47740.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-47740
- Aliases
- Published
- 2026-05-29T18:03:54.473Z
- Modified
- 2026-08-12T03:51:26.189619683Z
- Severity
-
- 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- Shopper: Authorization bypass in multiple Livewire admin components
- Details
-
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Multiple Filament actions on the admin Order detail and Order shipments table were callable by an authenticated low-privilege user without the permission required to mutate orders. The order detail actions cancel, mark paid, mark complete, capture payment, archive, and start processing were callable with the read-only readorders permission and did not require editorders. capturePayment could trigger an actual PSP capture (real funds movement). The order shipments table actions mark delivered and edit tracking were callable with the read-only browse_orders permission. A user with read access to orders could therefore alter the lifecycle of every order in the panel and trigger real-world payment captures. This vulnerability is fixed in 2.8.0.
- Database specific
{ "cwe_ids": [ "CWE-285", "CWE-862" ], "cna_assigner": "GitHub_M", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47740.json" }- References