Threats tagged 'ghsa-6wfw-fw32-2h84'

Shopper versions from 2.0.0 up to but not including 2.6.0 have a missing authorization vulnerability. This flaw allows users with only access_dashboard privileges in the admin panel to create new administrator accounts and grant permissions. Attackers can exploit this by directly invoking CreateTeamMember::store() or Permissions::togglePermission() via the /livewire/update endpoint, leading to privilege escalation to full administrator.