Impact
Multiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:
- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with
read_orders only and did not require edit_orders. capturePayment could trigger an actual PSP capture.
- Order shipments table actions (mark delivered, edit tracking) were callable with
browse_orders only.
- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on
store(), so any authenticated panel user could mutate product data without edit_products.
Settings/Team/Index had no mount() authorization at all — any authenticated user could create roles and delete other users.Settings/Team/RolePermission gated its write actions on the read-only view_users permission, allowing privilege escalation via the RBAC system itself.PaymentMethods, Currencies, Carriers table toggles and per-record actions had no per-action permission check.Customers/Create::store() re-passed a Hidden _password form field into the create payload.
Several public Eloquent model properties on Livewire components were not #[Locked], allowing client-side ID tampering.
A stored XSS surface existed on the product barcode field, which is rendered through DNS1DFacade::getBarcodeHTML() with {!! !!}.
Patches
Fixed in v2.8.0. Upgrade via:
composer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8
Workarounds
None. Upgrade to v2.8.0.
Resources
References
baradika Reporter
Impact
Multiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:
read_ordersonly and did not requireedit_orders.capturePaymentcould trigger an actual PSP capture.browse_ordersonly.store(), so any authenticated panel user could mutate product data withoutedit_products.Settings/Team/Indexhad nomount()authorization at all — any authenticated user could create roles and delete other users.Settings/Team/RolePermissiongated its write actions on the read-onlyview_userspermission, allowing privilege escalation via the RBAC system itself.PaymentMethods,Currencies,Carrierstable toggles and per-record actions had no per-action permission check.Customers/Create::store()re-passed a Hidden_passwordform field into the create payload.Several public Eloquent model properties on Livewire components were not
#[Locked], allowing client-side ID tampering.A stored XSS surface existed on the product barcode field, which is rendered through
DNS1DFacade::getBarcodeHTML()with{!! !!}.Patches
Fixed in
v2.8.0. Upgrade via:Workarounds
None. Upgrade to
v2.8.0.Resources
References