https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-23T18:08:47.924503+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-114387 CVE-2026-114387 — Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Components 2026-10-23T18:08:47.925373+00:00

Affected: shopperlabs shopper

Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store() or Permissions::togglePermission() directly over /livewire/update to create admin accounts and escalate to full administrator.