CVE-2026-56828

Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain authorization gaps after the earlier team-settings authorization fix. A staff member with only view_users and access_dashboard can mutate permissions, create an administrator, or delete roles. In packages/admin/src/Livewire/Components/Settings/Team/Permissions.php, togglePermission and removePermission authorize view_users rather than the stronger access_setting permission; packages/admin/resources/views/livewire/components/settings/team/permissions.blade.php exposes permission IDs in wire:click handlers. The attacker can grant arbitrary permissions to the bound role, including access_setting on the attacker's own role, or delete permission definitions. In packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php, mount() and store() also accept view_users, and the client-selected role_id can identify the admin role, allowing creation of a pre-verified administrator with an attacker-chosen password. In packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php, deleteAction has no action authorization and is only conditioned on can_be_removed, while page access requires view_users. Deleting a removable role removes access for assigned users, enabling RBAC denial of service as well as privilege escalation. This issue is fixed in version 2.8.1.