CVE-2026-56830: CVE-2026-56830: Broken Function Level Authorization in Shopper Media Component

#security #cve #cybersecurity

CVE-2026-56830: Broken Function Level Authorization in Shopper Media Component

Vulnerability ID: CVE-2026-56830
CVSS Score: 6.5
Published: 2026-09-11

An incomplete security fix in Shopper prior to version 2.9.2 exposes a Broken Function Level Authorization (BFLA) vulnerability in the Media component. Low-privileged administrative users with 'browse_products' permissions can bypass role-based access control policies to execute the 'store' action and modify product media.

TL;DR

Missing server-side authorization in Shopper's Livewire Media component allows low-privilege staff to maliciously overwrite product images.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-862
Attack Vector: Network (AV:N)
CVSS v3.1 Score: 6.5
Impact: High Integrity Loss (I:H)
Exploit Status: Proof of Concept (PoC) Available
CISA KEV Status: Not Listed

Affected Systems

Shopper (shopperlabs/shopper) Headless E-Commerce Admin Panel
shopperlabs/shopper: < 2.9.2 (Fixed in: 2.9.2)

Code Analysis

Commit: bf72e27

fix(admin): enforce authorization on unguarded settings and bulk actions (#570)

@@ -63,6 +63,8 @@ public function form(Schema $schema): Schema

     public function store(): void
     {
+        $this->authorize('edit_products');
+
         $this->validate();

         $this->product->update($this->form->getState());

Exploit Details

PoC Documentation: Exploit methodology and manual curl/Python instructions documented in security advisory GHSA-99h5-jhh7-v3r3

Mitigation Strategies

Upgrade Shopper package to version 2.9.2 or higher
Manually apply authorization checks in Media.php
Deploy WAF rules to inspect Livewire update requests

Remediation Steps:

Execute 'composer update shopperlabs/shopper' to update to version 2.9.2 or later
Verify that the Media.php file contains the 'authorize' call in the 'store' method
Deploy Web Application Firewall policies to monitor and block abnormal /livewire/update requests

References

Read the full report for CVE-2026-56830 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community