Detections
Analytics

SCA: security update for shopper/framework (GHSA-fxqw-97cc-7g5c)

medium Tenable Self-Hosted Container Security Plugin ID 442723

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, the admin tables for PaymentMethods,
 Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that
 were rendered for any authenticated panel user without checking the corresponding per-action permission. A
 low-privilege user could disable every payment method on the store, disable or alter the default currency,
 or disable carriers. The impact is a full denial of checkout and pricing integrity loss, reachable by any
 authenticated user. This vulnerability is fixed in 2.8.0. (CVE-2026-47745)

Solution

Update the shopper/framework library and its related packages to version 2.8.0 or later.

See Also

https://github.com/advisories/GHSA-fxqw-97cc-7g5c

Plugin Details

Severity: Medium

ID: 442723

Version: Revision 1.3

Type: Local

Family: SCA Checks

Published: 6/6/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.71

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:N

CVSS Score Source: CVE-2026-47745

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/5/2026

Vulnerability Publication Date: 5/29/2026

Reference Information

CVE: CVE-2026-47745

cwe: CWE-862