« Volver al listado

CVE-2026-47740

Estado: AplazadaAlta (8.1)—

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Multiple Filament actions on the admin Order detail and Order shipments table were callable by an authenticated low-privilege user without the permission required to mutate orders. The order detail actions cancel, mark paid, mark complete, capture payment, archive, and start processing were callable with the read-only read_orders permission and did not require edit_orders. capturePayment could trigger an actual PSP capture (real funds movement).

Leer descripción completaMostrar menos

The order shipments table actions mark delivered and edit tracking were callable with the read-only browse_orders permission. A user with read access to orders could therefore alter the lifecycle of every order in the panel and trigger real-world payment captures. This vulnerability is fixed in 2.8.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso autenticado remoto (PR:L) a servicio web sin privilegios suficientes (lectura vs. escritura). Usuario de bajo nivel altera ciclo de pedidos e inicia capturas de pago reales (manipulación de datos y funciones administrativas).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementApplication Developer GuidanceActive Directory ConfigurationVulnerability ScanningUser TrainingUser Account Management

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Shopper — ShopperAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-47740",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-47740",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-02T01:50:41.879905Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "shopperlabs",
          "product": "shopper",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.8.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-29T19:16:25.620",
  "references": [
    {
      "url": "https://github.com/shopperlabs/shopper/pull/511",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-f946-9qp6-vgch",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Multiple Filament actions on the admin Order detail and Order shipments table were callable by an authenticated low-privilege user without the permission required to mutate orders. The order detail actions cancel, mark paid, mark complete, capture payment, archive, and start processing were callable with the read-only read_orders permission and did not require edit_orders. capturePayment could trigger an actual PSP capture (real funds movement). The order shipments table actions mark delivered and edit tracking were callable with the read-only browse_orders permission. A user with read access to orders could therefore alter the lifecycle of every order in the panel and trigger real-world payment captures. This vulnerability is fixed in 2.8.0."
    },
    {
      "lang": "es",
      "value": "Shopper es un Panel de administración de e-commerce Headless. Antes de la versión 2.8.0, múltiples acciones de Filament en la tabla de detalles de pedidos y envíos de pedidos del administrador podían ser invocadas por un usuario autenticado con privilegios bajos sin el permiso requerido para modificar pedidos. Las acciones de detalle de pedidos cancelar, marcar como pagado, marcar como completado, capturar pago, archivar e iniciar procesamiento podían ser invocadas con el permiso de solo lectura read_orders y no requerían edit_orders. capturePayment podía desencadenar una captura real de PSP (movimiento real de fondos). Las acciones de la tabla de envíos de pedidos marcar como entregado y editar seguimiento podían ser invocadas con el permiso de solo lectura browse_orders. Un usuario con acceso de lectura a los pedidos podía, por lo tanto, alterar el ciclo de vida de cada pedido en el panel y desencadenar capturas de pago en el mundo real. Esta vulnerabilidad está corregida en la versión 2.8.0."
    }
  ],
  "lastModified": "2026-07-22T06:10:00.170",
  "sourceIdentifier": "security-advisories@github.com"
}