VulnSocial

CVE-2026-47744Disclosure

LOWCVSS 9.9 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, two distinct authorization defects in the team settings allowed any authenticated panel user to take over the RBAC system. Settings/Team/Index had no mount() authorization. Any authenticated user could load the page and use its public actions to create new roles and delete other users, including administrators. Settings/Team/RolePermission gated its write actions on the read-only view_users permission. Any user holding view_users could grant themselves or any other user arbitrary permissions, including manage_users and edit_orders, effectively escalating to full panel administrator from a read-only account. Combined, these two defects allow a low-privilege authenticated user to obtain administrator privileges and remove the legitimate administrators from the panel. This vulnerability is fixed in 2.8.0.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-269CWE-285

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-05-29: 2Technical Details · 2026-05-29: 205-29
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-47744 Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, two distinct authorization defects in the team settings allowed any authenticated panel user to take ove… https://www.cve.org/CVERecord?id=CVE-2026-47744 ----- Traducción: CVE-2026-47744 Sho… http://infoflow.cloud`

    Post summary

    The post announces CVE-2026-47744, noting two authorization flaws in the Shopper headless admin panel, but offers no proof of concept, exploit code, evidence of active exploitation, or patch/workaround information.

    0000042
    79 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-47744 Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, two distinct authorization defects in the team settings allowed any authenticated panel user to take ove… https://www.cve.org/CVERecord?id=CVE-2026-47744

    Post summary

    The statement announces CVE-2026-47744, describing two authorization flaws in Shopper’s admin panel that enable authenticated users to take over, but provides no PoC, exploit, patch information, or evidence of active exploitation.

    00000173
    57.5K followersView on X

Explore more

Back to dashboard