Three Livewire admin components in shopper/framework (v2.8.0 through before v2.9.2) improperly gate state-mutating actions on the 'view_users' permission, which is intended as read-only. This misclassification allows a user with 'view_users' and 'access_dashboard' permissions to escalate privileges by granting any permission to their role, creating new admin users with chosen passwords, and deleting permissions or roles. The vulnerability is due to improper authorization checks in methods such as togglePermission, removePermission, and store, which call authorize('view_users') instead of the stricter authorize('access_setting'). The issue was introduced as a residual gap in a security fix commit and is confirmed by regression tests in the project's own test suite. The CVSS 3.1 score is 8.8 (High) with CWE-285 and CWE-862 classifications.

An attacker with limited 'view_users' permission can escalate privileges to full admin by granting themselves additional permissions or creating new admin users. They can also delete permissions or roles, potentially causing denial of service in role-based access control. This compromises confidentiality, integrity, and availability of the system's administrative functions.

A patch is available that changes authorization checks from 'view_users' to 'access_setting' in the affected components. Users should update to a fixed version that includes these changes. The suggested fix includes modifying authorization calls in togglePermission, removePermission, mount, and store methods, and adding authorization to the deleteAction method. Regression tests should be updated accordingly. No additional mitigation is required beyond applying the official fix.