GHSA-fxqw-97cc-7g5c
Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | shopper/framework | < 2.8.0 | 2.8.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
## Impact
The admin tables for `PaymentMethods`, `Currencies` and `Carriers` exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could:
- Disable every payment method on the store, blocking checkout.
- Disable or alter the default currency, changing displayed prices and the exchange rate basis.
- Disable carriers, breaking shipping rate computation at checkout.
The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user.
## Patches
Fixed in `v2.8.0`. Each toggle and per-record action now requires its matching permission (`edit_payment_methods`, `edit_currencies`, `edit_carriers`).
Upgrade via:
```bash
composer require shopper/admin:^2.8
```
## Workarounds
None. Upgrade to `v2.8.0`.
References
External links from the advisory. They lead to third-party sites.