PT-2026-44941 · Shopper · Shopper

Published 2026-05-29 · Updated 2026-05-29 · CVE-2026-47740

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Shopper versions prior to 2.8.0

Description Authenticated low-privilege users can call multiple Filament actions on the admin Order detail and Order shipments table without the necessary permissions to mutate orders. Specifically, the actions cancel, mark paid, mark complete, capture payment, archive, and start processing are accessible with the read-only read orders permission instead of requiring edit orders. The capturePayment() function can trigger an actual Payment Service Provider (PSP) capture, resulting in real funds movement. Additionally, the mark delivered and edit tracking actions in the order shipments table are accessible with the read-only browse orders permission. This allows a user with read access to alter the lifecycle of any order and trigger payment captures.

Recommendations Update to version 2.8.0.

Fix

Improper Authorization

Missing Authorization

Weakness Enumeration

CWE-285

CWE-862

Related Identifiers

CVE-2026-47740

Affected Products

Shopper

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-47740 · Security Note
• https://github.com/shopperlabs/shopper/pull/511 · Note
• https://github.com/shopperlabs/shopper/security/advisories/GHSA-f946-9qp6-vgch · Note
• https://twitter.com/infoflowcloud/status/2060471438851572037 · Twitter Post
• https://twitter.com/CVEnew/status/2060470692483674435 · Twitter Post