CVE-2026-114387
Last modified
CVE-2026-114387 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store() or Permissions::togglePermission() directly over /livewire/update to create admin accounts and escalate to full administrator.. EPSS estimates a 0.32% chance of exploitation in the next 30 days.
Description
Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store() or Permissions::togglePermission() directly over /livewire/update to create admin accounts and escalate to full administrator.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-114387?
How severe is CVE-2026-114387?
How do I fix CVE-2026-114387?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-114380A vulnerability was found in itsourcecode Online Cake Orderi…6.3
- CVE-2026-114381A vulnerability was determined in itsourcecode Online Cake O…6.3
- CVE-2026-114382A security flaw has been discovered in TOTOLINK EX200 5.2.3c…10
- CVE-2026-114383A weakness has been identified in TOTOLINK EX200 5.2.3c.7200…10
- CVE-2026-114384A security vulnerability has been detected in itsourcecode O…6.3
- CVE-2026-114386Pydantic AI Harness before 0.59.0 fails to enforce UsageLimi…4.8
- CVE-2026-114388Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0…5.3
- CVE-2026-114389Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a …4.3
- CVE-2026-11439A vulnerability was found in theonedev onedev up to 15.0.5. …6.3
- CVE-2026-114390Chamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a …5.3
- CVE-2026-114391ZenTao PMS before 22.3 contains an authorization bypass vuln…7.1
- CVE-2026-114392Trudesk through 1.2.11 contains an authorization bypass vuln…5.3
Are you affected by CVE-2026-114387?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST