Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Shopper's Packagist package shopper/framework is affected in versions before 2.8.0. In the team settings, a missing authorization check on the team page and a write-permission check tied to the read-only view_users permission let any authenticated panel user, including one holding only view_users, create roles, delete users, and grant arbitrary permissions, including administrator rights. Upgrade to shopper/framework 2.8.0, which adds the missing checks and requires manage_users for the affected write actions; the source lists no workaround.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 9.9 | Critical | 3.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0032, the 25th percentile, on 15 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 13:57 UTC First seen by agentprime
- 31 Oct 2026, 13:57 UTC Confirmed by OSV