DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-56825: CVE-2026-56825: Missing Authorization and State Tampering in Shopper e-commerce Admin Panel

#security #cve #cybersecurity

CVE-2026-56825: Missing Authorization and State Tampering in Shopper e-commerce Admin Panel

Vulnerability ID: CVE-2026-56825
CVSS Score: 8.1
Published: 2026-09-11

A critical authorization bypass and insecure direct object reference (IDOR) vulnerability was discovered in Shopper, a Headless e-commerce Admin Panel. Due to missing authorization chains on table actions and the lack of a locked property on the collection state model, authenticated low-privilege staff can detach products from arbitrary collections.

TL;DR

An authenticated attacker with only low-level collection browsing access can exploit insecure Livewire state handling and missing authorization checks to detach products or empty arbitrary collections in the Shopper admin panel, disrupting catalog integrity and storefront presentation.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-862
  • Attack Vector: Network
  • CVSS v3.1: 8.1 (High)
  • Exploit Status: Proof-of-Concept
  • CISA KEV Status: Not Listed
  • Impact: High Integrity & High Availability Damage
  • Remediation: Upgrade to Shopper v2.9.2 or apply manual hotfix

Affected Systems

  • Shopper Headless e-commerce Admin Panel < 2.9.2
  • shopper: < 2.9.2 (Fixed in: 2.9.2)

Code Analysis

Commit: bf72e27

fix(admin): enforce authorization on unguarded settings and bulk actions (#570)

Exploit Details

  • GitHub: Security advisory detailing administrative component authorization bypasses.

Mitigation Strategies

  • Upgrade the shopperlabs/shopper package to version 2.9.2 or later.
  • Apply manual hotfix by appending #[Locked] attribute and ->authorize('delete_collections') method to CollectionProducts.php.
  • Implement Web Application Firewall (WAF) rules to inspect Livewire update requests.
  • Perform code audits of custom Livewire components to ensure public model properties are secure.

Remediation Steps:

  1. Execute 'composer update shopperlabs/shopper' to update the package to v2.9.2.
  2. If updating is not possible, open 'packages/admin/src/Livewire/Components/Collection/CollectionProducts.php'.
  3. Add the import statement: 'use Livewire\Attributes\Locked;' at the top of the file.
  4. Apply the '#[Locked]' attribute directly above the 'public Collection $collection;' property declaration.
  5. Chain the '->authorize("delete_collections")' method to both 'Action::make("delete")' and 'DeleteBulkAction::make()' configurations.

References

Read the full report for CVE-2026-56825 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)