CVE-2026-47744

creationtimestamp| type| source ---|---|--- 2026-05-29 20:01:33+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmzdburqpr2d...

CVE-2026-47744 Shopper: Authorization bypass and RBAC privilege escalation in team settings

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, two distinct authorization defects in the team settings allowed any authenticated panel user to take over the RBAC system. Settings/Team/Index had no mount authorization. Any authenticated user could load the page and use its public...